SSL certificate for website – no legal company name

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect $HOST:$PORTNUMBER -servername $SERVERNAME \
    | openssl x509 > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

The -servername is used to select the correct certificate when multiple are presented, in the case of SNI.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts. The x509 at the end will strip out the intermediate certs, you will need to use sed -n '/-----BEGIN/,/-----END/p' instead of the x509 at the end.

echo -n gives a response to the server, so that the connection is released

openssl x509 removes information about the certificate chain and connection details. This is the preferred format to import the certificate into other keystores.

You cannot generally get SSL certificates issued with an IP address as a subject name.

Firstly, you have no basis with which to get such a certificate issued unless the IP block is delegated to you (from an RIR, for example). This means that unless you are listed and named in the whois information for that IP block, you will not get a certificate.

Secondly, not all certificate authorities will do this even in that case.

Your elastic IP is a little like a subdomain in this sense. It's available for your use, and associated with you in the context of your provider, but as far as ICANN and its descendants are concerned it isn't yours.