--- a/util/x509.lua	Sun Mar 22 11:20:42 2026 +0100
+++ b/util/x509.lua	Tue Jan 13 07:13:25 2026 +0100
@@ -25,6 +25,7 @@
 local base64 = require "prosody.util.encodings".base64;
 local log = require "prosody.util.logger".init("x509");
 local mt = require "prosody.util.multitable";
+local ip = require "prosody.util.ip";
 local s_format = string.format;
 local ipairs = ipairs;
 
@@ -72,6 +73,20 @@
 	return false
 end
 
+local function compare_ipaddress(host, asserted_names)
+	local host_ip = ip.new_ip(host:match("^%[([%x:.]+)%]$") or host);
+	if not host_ip then return false end
+
+	for i=1,#asserted_names do
+		if ip.new_ip(asserted_names[i]) == host_ip then
+			log("debug", "Cert iPAddress %s matched IP address", host_ip);
+			return true;
+		end
+	end
+
+	return false
+end
+
 -- Compare an XMPP domain name with the asserted id-on-xmppAddr
 -- identities extracted from a certificate.  Both are UTF8 strings.
 --
@@ -172,6 +187,9 @@
 		if sans["dNSName"] then
 			if compare_dnsname(host, sans["dNSName"]) then return true end
 		end
+		if sans["iPAddress"] then
+			if compare_ipaddress(host, sans["iPAddress"]) then return true end
+		end
 	end
 
 	-- Per [TLS-IDENT] ignore the Common Name
@@ -224,6 +242,15 @@
 				end
 			end
 		end
+		if sans["iPAddress"] then
+			for _, addr in ipairs(sans["iPAddress"]) do
+				if addr:find(":") then
+					names:set("[" .. addr .. "]", "*", true);
+				else
+					names:set(addr, "*", true);
+				end
+			end
+		end
 	end
 
 	local subject = cert:subject();