--- a/net/resolvers/basic.lua	Tue Mar 24 12:51:01 2026 +0000
+++ b/net/resolvers/basic.lua	Tue Mar 24 17:28:53 2026 +0100
@@ -73,6 +73,12 @@
 		return;
 	end
 
+	if not self.port then
+		self.last_error = "indeterminate port";
+		cb(nil);
+		return;
+	end
+
 	if not self.hostname then
 		self.last_error = "hostname failed IDNA";
 		cb(nil);
@@ -131,7 +137,7 @@
 	if not is_ip and hostname:sub(1,1) == '[' then
 		is_ip = inet_pton(hostname:sub(2,-2));
 	end
-	if is_ip then
+	if is_ip and port then
 		hostname = inet_ntop(is_ip);
 		if #is_ip == 16 then
 			targets = { { conn_type.."6", hostname, port, extra } };

--- a/net/resolvers/service.lua	Tue Mar 24 12:51:01 2026 +0000
+++ b/net/resolvers/service.lua	Tue Mar 24 17:28:53 2026 +0100
@@ -154,8 +154,8 @@
 	if not is_ip and hostname:sub(1,1) == '[' then
 		is_ip = inet_pton(hostname:sub(2,-2));
 	end
-	if is_ip and extra and extra.default_port then
-		return basic.new(hostname, extra.default_port, conn_type, extra);
+	if is_ip then
+		return basic.new(hostname, extra and extra.default_port, conn_type, extra);
 	end
 
 	return setmetatable({

--- a/util/x509.lua	Tue Mar 24 12:51:01 2026 +0000
+++ b/util/x509.lua	Tue Mar 24 17:28:53 2026 +0100
@@ -25,6 +25,7 @@
 local base64 = require "prosody.util.encodings".base64;
 local log = require "prosody.util.logger".init("x509");
 local mt = require "prosody.util.multitable";
+local ip = require "prosody.util.ip";
 local s_format = string.format;
 local ipairs = ipairs;
 
@@ -72,6 +73,20 @@
 	return false
 end
 
+local function compare_ipaddress(host, asserted_names)
+	local host_ip = ip.new_ip(host:match("^%[([%x:.]+)%]$") or host);
+	if not host_ip then return false end
+
+	for i=1,#asserted_names do
+		if ip.new_ip(asserted_names[i]) == host_ip then
+			log("debug", "Cert iPAddress %s matched IP address", host_ip);
+			return true;
+		end
+	end
+
+	return false
+end
+
 -- Compare an XMPP domain name with the asserted id-on-xmppAddr
 -- identities extracted from a certificate.  Both are UTF8 strings.
 --
@@ -172,6 +187,9 @@
 		if sans["dNSName"] then
 			if compare_dnsname(host, sans["dNSName"]) then return true end
 		end
+		if sans["iPAddress"] then
+			if compare_ipaddress(host, sans["iPAddress"]) then return true end
+		end
 	end
 
 	-- Per [TLS-IDENT] ignore the Common Name
@@ -224,6 +242,15 @@
 				end
 			end
 		end
+		if sans["iPAddress"] then
+			for _, addr in ipairs(sans["iPAddress"]) do
+				if addr:find(":") then
+					names:set("[" .. addr .. "]", "*", true);
+				else
+					names:set(addr, "*", true);
+				end
+			end
+		end
 	end
 
 	local subject = cert:subject();