I'm trying to connect to an embedded device with an HTTP-server which works fine on android < P (until I set `targetSdkVersion 28`) because there was a change that [Network TLS enabled by default](https://developer.android.com/preview/features/security-behav#tls-enabled).

There is a way to [Opt out of cleartext traffic](https://developer.android.com/training/articles/security-config#CleartextTrafficPermitted) but it seems that this is **only possible for domains** and **not IP addresses**.

---

I've tried to set a `android:networkSecurityConfig` in the Manifest with the IP instead of the domain but this didn't work:

```
<network-security-config>
  <domain-config cleartextTrafficPermitted="false">
    <domain includeSubdomains="true">172.16.33.1</domain>
  </domain-config>
</network-security-config>

```

Setting this as a `<base-config cleartextTrafficPermitted="false">` does not work either.

---

So it seems that there is no way to get non-TLS communication working *when not having a domain*. But because this is an embedded device in the local network we do not have a domain (we only know the IP).

This seems like a major problem for all kind of embedded devices which would not be able to communicate anymore. Plus, ["new apps and updates to existing apps require to target API level [28 in November 2020]"](https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html) (starting in November 2018 with API 26 and advancing each year).

Any ideas how to make this possible?