Accept that you have to? Or generate a new vault server certificate that does have IP SAN for 127.0.0.1