Re: "We decided on a global fallback"
You can get certs that work for IP addresses. Of course a secondary problem is that certs expire too and many embedded devices might even use self signed certs or certs signed by other certs which aren't in the browser's trusted certs list.