From f8af511952d2e81cee5953c96fa67c56964323c0 Mon Sep 17 00:00:00 2001
From: Dirk Wetter <dirk@testssl.sh>
Date: Wed, 27 May 2026 16:53:06 +0200
Subject: [PATCH] Improve PR #3041

* move message when scanning IP address to the very beginning, inside parse_cmd_line()
* improve message
* just check whether there are no chars a-zA-Z

* move [[ $caa_node =~ '.'$ ]] || caa_node+="." into the while loop
---
 testssl.sh | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/testssl.sh b/testssl.sh
index fd6399b..06d422c 100755
--- a/testssl.sh
+++ b/testssl.sh
@@ -10273,9 +10273,9 @@ certificate_info() {
           fileout "${jsonID}${json_postfix}" "INFO" "not checked (IP address scan)"
      else
           caa_node="$NODE"
-          [[ $caa_node =~ '.'$ ]] || caa_node+="."     # force FQDN to prevent dig search-domain expansion
           caa=""
           while [[ -z "$caa" ]] &&  [[ -n "$caa_node" ]]; do
+               [[ $caa_node =~ '.'$ ]] || caa_node+="."     # force FQDN to prevent dig search-domain expansion
                caa="$(get_caa_rr_record $caa_node)"
                tmp=${PIPESTATUS[@]}
                [[ $DEBUG -ge 4 ]] && echo "get_caa_rr_record: $tmp"
@@ -23611,10 +23611,6 @@ display_rdns_etc() {
                outln " A record via:          $CORRECT_SPACES supplied IP \"$CMDLINE_IP\""
           fi
      fi
-     if is_ipv4addr "$NODE" || is_ipv6addr "$NODE"; then
-          prln_warning " Warning: IP scan -- Trust, CAA and SNI-dependent checks may be unreliable. Rescan with hostname for accurate results."
-          fileout "ip_scan_warning" "WARN" "Scanning by IP address: Trust, CAA and SNI-dependent checks may be unreliable"
-     fi
      if [[ "$rDNS" =~ instructed ]]; then
           out "$(printf " %-23s " "rDNS ($nodeip):")"
           out "$rDNS"
@@ -24682,6 +24678,7 @@ parse_cmd_line() {
      local outfile_arg=""
      local cipher_mapping
      local -i subret=0
+     local tmp=""
 
      CMDLINE="$(create_cmd_line_string "${CMDLINE_ARRAY[@]}")"
      CMDLINE_PARSED=false
@@ -25361,6 +25358,14 @@ parse_cmd_line() {
           set_rating_state
      fi
 
+     tmp=${URI#*//}      # remove https://
+     if [[ ! $tmp =~ [a-zA-Z] ]]; then
+          # No letters indicate it's not a name
+          outln
+          pr_warning " Warning: Target is not a server name: results may be completely wrong, at minimum trust may show false results."
+          fileout "ip_scan_warning" "WARN" "Target is not a server name: results may be completely wrong, at minimum trust may show false results."
+     fi
+
      CMDLINE_PARSED=true
 }