# How to disable direct https://ipaddress visit?
**URL:** https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927
**Category:** Self-hosting
**Tags:** tablet
**Created:** [September 9, 2016, 10:06am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927 "2016-09-09T10:06:20Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [September 9, 2016, 10:06am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/1 "2016-09-09T10:06:20Z")
see title.
How to prohibit [https://ipaddress](https://ipaddress) visit the website or using [http://ip:443](http://ip:443)?
How to configure in the docker nginx?
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [September 9, 2016, 11:57am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/2 "2016-09-09T11:57:04Z")
I can’t answer how, but I want to ask _why?_
---
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [September 9, 2016, 12:52pm UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/3 "2016-09-09T12:52:32Z")
the reason is let all traffic go through the name server. you can only just visit from the domain name.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [September 9, 2016, 2:34pm UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/4 "2016-09-09T14:34:40Z")
Step 1: get a valid certificate for your IP address.
---
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [September 9, 2016, 4:27pm UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/5 "2016-09-09T16:27:14Z")
ssl was installed. [https://mydomain.com](https://mydomain.com) can be visited. but [https://myip](https://myip) can also be visited with the warning of certification. how to prohibit ip visition？
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [September 9, 2016, 4:28pm UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/6 "2016-09-09T16:28:55Z")
Did you try this?
>
---
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [September 9, 2016, 4:42pm UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/7 "2016-09-09T16:42:34Z")
yes，you got my point. what i mean is how to set up in discourse docker nginx，need rebuild？
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [September 9, 2016, 4:46pm UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/8 "2016-09-09T16:46:03Z")
Modifing nginx conf inside the container is done trough the app.yml file.
For an example, see [here](https://meta.discourse.org/t/how-to-add-a-custom-http-header-to-your-discourse/26439).
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [September 9, 2016, 10:42pm UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/9 "2016-09-09T22:42:49Z")
> [@doudou](#):
>
> but [https://myip](https://myip) can also be visited with the warning of certification
That’s why step 1 is:
> [@mpalmer](#):
>
> get a valid certificate **for your IP address**.
> [@Falco](#):
>
> Did you try this?
That won’t work on HTTPS sites, because all the redirection, hostname checking, etc happens _after_ the SSL negotiation is complete.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [September 9, 2016, 11:30pm UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/10 "2016-09-09T23:30:35Z")
Wait, they want to NOT let people visit with just the IP.
Which is a little odd - exactly what harm is this doing, @doudou?
---
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [September 10, 2016, 1:18am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/11 "2016-09-10T01:18:29Z")
just for prohibition. can this be done in system setting，like firewall？
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [September 10, 2016, 1:35am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/12 "2016-09-10T01:35:58Z")
You can’t do what you want to do using a firewall. In order to do what you want to achieve, you must first **get a valid, trusted certificate for your server’s IP address**. Until you have that, nothing else can be done. Talk to your preferred CA to organise that.
---
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [September 10, 2016, 2:09am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/13 "2016-09-10T02:09:24Z")
i just want when people visit the website via [https://serverip](https://serverip) he will get an internal 500 page or nothing at all and cant go on by clicking trust the certification. so i am seaching for the solution on nginx or firewall. any sugguestion？
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [September 10, 2016, 2:10am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/14 "2016-09-10T02:10:51Z")
It can’t be done unless you have a valid, trusted cert for your IP address. This is why I keep telling you to **get a valid, trusted certificate for your server’s IP address**.
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [September 10, 2016, 3:30am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/15 "2016-09-10T03:30:51Z")
Nah, I think @doudou here would be happy if, after they clicked past the bad cert warning, _then_ they got the 500 page.
So a 99-year self-signed cert for the IP address would be fine.
One of many how-to guides for that: [http://www.cyberciti.biz/faq/nginx-self-signed-certificate-tutorial-on-centos-redhat-linux/](http://www.cyberciti.biz/faq/nginx-self-signed-certificate-tutorial-on-centos-redhat-linux/)
---
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [September 10, 2016, 4:06am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/16 "2016-09-10T04:06:34Z")
this could not be intergreted with domain name and with discourse using self sign and public CA
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [September 10, 2016, 6:48am UTC](https://meta.discourse.org/t/how-to-disable-direct-https-ipaddress-visit/49927/17 "2016-09-10T06:48:44Z")
With SNI, you can have multiple certificates. During the SSL negotiation the browser tells the server what name it is trying to reach, and the server returns the appropriate cert. The link I provided appeared to have instructions for SNI under nginx. Your regular site could use your regular cert.