With own SSL certificates generated without ipaddress in SAN, consul members fails with error x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs

Question: is it compulsory to have that IP Address in SAN for own generated certificates?
we created our certificate without IP Address in the SAN
when we are making https request it fails with that error

Overview:

Consul TLS with own ssl certificates generated without ipaddress in SAN fails with error x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs

#### Reproduction Steps

Steps to reproduce this issue, Configured consul in TLS mode, run the command consul members with ip address

```
export CONSUL_HTTP_SSL=true
export CONSUL_CACERT=/users/test1/consulcerts/ra-anchors.pem
export CONSUL_CLIENT_CERT=/users/test1/consulcerts/cert-chain.pem
export CONSUL_CLIENT_KEY=/users/test1/consulcerts/keystore_key.key

consul members -http-addr=127.0.0.1:8501
Error retrieving members: Get https://127.0.0.1:8501/v1/agent/members?segment=_all: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs
```

```
consul members -http-addr=localhost:8501
Node Address Status Type Build Protocol DC Segment
test1@consul-server0 192.168.2.100:8301 alive server 1.6.2 2 test-dc1
test1@tc1-cloudera-e1-0 192.168.2.103:8301 alive client 1.6.2 2 test-dc1
```

tls.json:
```
{
"ports": {
"https": 8501
},
"ca_file" : "/users/test1/consulcerts/ra-anchors.pem",
"cert_file" : "/users/test1/consulcerts/cert-chain.pem",
"key_file" : "/users/test1/consulcerts/keystore_key.key",
"verify_incoming" : true,
"verify_outgoing" : true
}
```

config.json:
```
{
"node_name": "test1@consul-server0",
"bind_addr": "192.168.2.100",
"data_dir": "../data",
"bootstrap_expect": 1,
"server": true,
"log_level":"debug",
"ports": {
"server": 8300,
"serf_lan": 8301,
"serf_wan": 8302,
"dns": 8600,
"http": 8500
},
"disable_update_check": true,

"retry_join": [

],
"addresses": {
"http": "0.0.0.0"
},
"rejoin_after_leave": true,
"disable_update_check": true,
"raft_protocol": 2,
"datacenter": "test-dc1"
}
```

Start with the `consul members` command using `-http-addr=127.0.0.1:8501` and the TLS settings in `tls.json`; compare its behavior with the successful `localhost` request. Determine whether the reported certificate-validation behavior is expected and document or address the required certificate SAN configuration, with the two reproduced commands as the completion check.

Written by the indexing model from the issue text.