title: Android P without TLS: network-security-config: cleartextTrafficPermitted not possible for IP (only domain)
body: <p>I'm trying to connect to an embedded device with an HTTP-server which works fine on android &lt; P (until I set <code>targetSdkVersion 28</code>) because there was a change that <a href="https://developer.android.com/preview/features/security-behav#tls-enabled" rel="noreferrer">Network TLS enabled by default</a>.</p>
  
  <p>There is a way to <a href="https://developer.android.com/training/articles/security-config#CleartextTrafficPermitted" rel="noreferrer">Opt out of cleartext traffic</a> but it seems that this is <strong>only possible for domains</strong> and <strong>not IP addresses</strong>.</p>
  
  <hr>
  
  <p>I've tried to set a <code>android:networkSecurityConfig</code> in the Manifest with the IP instead of the domain but this didn't work:</p>
  
  <pre><code>&lt;network-security-config&gt;
    &lt;domain-config cleartextTrafficPermitted="false"&gt;
      &lt;domain includeSubdomains="true"&gt;172.16.33.1&lt;/domain&gt;
    &lt;/domain-config&gt;
  &lt;/network-security-config&gt;
  </code></pre>
  
  <p>Setting this as a <code>&lt;base-config cleartextTrafficPermitted="false"&gt;</code> does not work either.</p>
  
  <hr>
  
  <p>So it seems that there is no way to get non-TLS communication working <em>when not having a domain</em>. But because this is an embedded device in the local network we do not have a domain (we only know the IP).</p>
  
  <p>This seems like a major problem for all kind of embedded devices which would not be able to communicate anymore. Plus, <a href="https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html" rel="noreferrer">"new apps and updates to existing apps require to target API level [28 in November 2020]"</a> (starting in November 2018 with API 26 and advancing each year).</p>
  
  <p>Any ideas how to make this possible?</p>