That’s the correct encoding of an IPv4 address according to the X.509 spec. It gets decoded to a 4-tuple elsewhere during hostname verification.
So it seems :ssl treats a string/charlist value in the first argument of :ssl.connect/3 as a hostname and tries to match it against the hostnames in the certificate. So unless the IP address also appears as dNSName: ~c"10.0.0.1" it is not going to match. If you call :ssl.connect/3 with a tuple as the first argument (e.g. {10, 0, 0, 1}) everything works as expected.
Now, you are not calling :ssl.connect/3 directly, your HTTP client library parses the URL and handles the connection establishment, so you can’t pass a tuple. Unless you want to propose upstream changes to the way the TLS connection is established when a URL has an IP address instead of a hostname, you could add the mapping to the hostname verification:
def custom_hostname_check({:dns_id, hostname}, {:iPAddress, ip} do
case :inet.parse_address(hostname) do
{:ok, ^ip} -> true
_ -> :default
end
end
def custom_hostname_check(_, _), do: :default
And then select this function by passing customize_hostname_check: [match_fun: &custom_hostname_check/1].
