When you generate your new certificate, instead of just adding your ip to tls-san, add your dns, so that if you later change your ip, you do not have regenerate your cluster