Optional comma-separated list of IP Subject Alternative Names, e.g. 10.0.0.1,192.168.1.100.

The PKI role must have allow_ip_sans=true for this to be accepted by Vault. Leave blank if IP SANs are not required.