diff --git a/apps/smp-server/Main.hs b/apps/smp-server/Main.hs
index 4f32f554c..cfd7f4531 100644
--- a/apps/smp-server/Main.hs
+++ b/apps/smp-server/Main.hs
@@ -186,6 +186,9 @@ initializeServer InitOptions {enableStoreLog, signAlgorithm, ip, fqdn} = do
             \authorityKeyIdentifier = keyid:always\n\
             \basicConstraints = critical,CA:true\n"
         -- TODO revise https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3, https://www.rfc-editor.org/rfc/rfc3279#section-2.3.5
+        -- IP and FQDN can't both be used as server address interchangeably even if IP is added
+        -- as Subject Alternative Name, unless the following validation hook is disabled:
+        -- https://hackage.haskell.org/package/x509-validation-1.6.10/docs/src/Data-X509-Validation.html#validateCertificateName
         createOpensslServerConf =
           writeFile
             opensslServerConfFile
@@ -197,17 +200,10 @@ initializeServer InitOptions {enableStoreLog, signAlgorithm, ip, fqdn} = do
                 <> "[v3]\n\
                    \basicConstraints = CA:FALSE\n\
                    \keyUsage = digitalSignature, nonRepudiation, keyAgreement\n\
-                   \extendedKeyUsage = serverAuth\n\
-                   \subjectAltName = @alt_names\n\n\
-                   \[alt_names]\n"
-                <> optionalDns1
-                <> ("IP.1 = " <> ip <> "\n")
+                   \extendedKeyUsage = serverAuth\n"
             )
           where
             cn = fromMaybe ip fqdn
-            optionalDns1 = case fqdn of
-              Nothing -> ""
-              Just n -> "DNS.1 = " <> n <> "\n"
 
     saveFingerprint = do
       Fingerprint fp <- loadFingerprint caCrtFile
diff --git a/tests/fixtures/openssl_server.conf b/tests/fixtures/openssl_server.conf
index 4fa8886da..bbf643480 100644
--- a/tests/fixtures/openssl_server.conf
+++ b/tests/fixtures/openssl_server.conf
@@ -9,8 +9,3 @@ CN = localhost
 basicConstraints = CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyAgreement
 extendedKeyUsage = serverAuth
-subjectAltName = @alt_names
-
-[alt_names]
-DNS.1 = localhost
-IP.1 = 127.0.0.1
diff --git a/tests/fixtures/server.crt b/tests/fixtures/server.crt
index d869c5a4f..68234a19a 100644
--- a/tests/fixtures/server.crt
+++ b/tests/fixtures/server.crt
@@ -1,12 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIIB2jCCAVqgAwIBAgIUOMoaJ+qlkiUwq5MW7LDi+sHu64IwBQYDK2VxMCoxFjAU
+MIIBvDCCATygAwIBAgIUUgqht3ibEJ9jp5JuroML5Baxa/IwBQYDK2VxMCoxFjAU
 BgNVBAMMDVNNUCBzZXJ2ZXIgQ0ExEDAOBgNVBAoMB1NpbXBsZVgwIBcNMjIwMTEx
-MTExODAyWhgPNDc1OTEyMDgxMTE4MDJaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDBD
-MAUGAytlcQM6AJXsy+S9i3Qdftydn51/p/6a0Ml9vJsYonAwv6CzpIOVG5e3Ath1
-wUfrS0YETmZe0EA7Nk40UKRSgKOBjDCBiTAJBgNVHRMEAjAAMAsGA1UdDwQEAwID
-yDATBgNVHSUEDDAKBggrBgEFBQcDATAaBgNVHREEEzARgglsb2NhbGhvc3SHBH8A
-AAEwHQYDVR0OBBYEFPuA/LW1tq1byaZ4Rrx4JON60JlEMB8GA1UdIwQYMBaAFBxQ
-m9HuabbrLExB8KxaBufAyYlUMAUGAytlcQNzABfc1ODnEfcpAsRmOjYIuyhMvJFE
-sGnjf0TRk4vNS5vs2+CfEGHjKOrbAUDwhUI0Al26WpSvxMcvAE2E0qQoCSRS5Pa8
-+FgzzN3WfFMcXnuYAiqOp8op2mtsp5aJ3UIkwncItp5w+kICiWV6LL3QJM4zAA==
+MTYzOTQ2WhgPNDc1OTEyMDgxNjM5NDZaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDBD
+MAUGAytlcQM6AFj+fmjmgOMBFgQ7lXfICSlSaB5sYp1wzhM2IaqgmVhWbDs3Tw7W
+oUXFJsWpKku1kFjLH2yhqIInAKNvMG0wCQYDVR0TBAIwADALBgNVHQ8EBAMCA8gw
+EwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFMjbHbxESDI8YDPjJ8kXWjkg
+jHxmMB8GA1UdIwQYMBaAFBxQm9HuabbrLExB8KxaBufAyYlUMAUGAytlcQNzAP98
+RpFacmjxsc07GwC07uAxUxNgxX4R2nA+0St866uFbdyxApiyn44giG+m+YXCXLjh
+1ffKEhhqAPdlpzByLarx8EWgmOsisBCRWrmraksOV15FKxjPqm7OYKp4f9GvieAQ
+o/SKOyZVVdcZX7NcuDUxAA==
 -----END CERTIFICATE-----
diff --git a/tests/fixtures/server.key b/tests/fixtures/server.key
index 66c77a892..27e0b7caa 100644
--- a/tests/fixtures/server.key
+++ b/tests/fixtures/server.key
@@ -1,4 +1,4 @@
 -----BEGIN PRIVATE KEY-----
-MEcCAQAwBQYDK2VxBDsEOY3wzMxEAnHIJ36bmp+0YfaGUUdHPfS4y+DD+KmSrslz
-PQPIY/SZc5orjPuF66RlEutpkqHBNE3WMg==
+MEcCAQAwBQYDK2VxBDsEOZcXSjKQ3FQ9EBfqHmFIidOu4LecpUgi5NVPMhx7mS2d
+QNQ0lFasp+EfvLErbs1Sd9xLVxA1hnZJng==
 -----END PRIVATE KEY-----