diff --git a/backend/src/ee/routes/v1/gateway-router.ts b/backend/src/ee/routes/v1/gateway-router.ts
index bd2ac2739..860e5b66b 100644
--- a/backend/src/ee/routes/v1/gateway-router.ts
+++ b/backend/src/ee/routes/v1/gateway-router.ts
@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { GatewaysSchema } from "@app/db/schemas";
+import { isValidIp } from "@app/lib/ip";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -16,6 +17,10 @@ const SanitizedGatewaySchema = GatewaysSchema.pick({
   serialNumber: true,
   heartbeat: true
 });
+const isValidRelayAddress = (relayAddress: string) => {
+  const [ip, port] = relayAddress.split(":");
+  return isValidIp(ip) && Number(port) <= 65535 && Number(port) >= 49152;
+};
 
 export const registerGatewayRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -54,7 +59,7 @@ export const registerGatewayRouter = async (server: FastifyZodProvider) => {
     },
     schema: {
       body: z.object({
-        relayAddress: z.string()
+        relayAddress: z.string().refine(isValidRelayAddress, { message: "Invalid relay address" })
       }),
       response: {
         200: z.object({
diff --git a/backend/src/ee/services/gateway/gateway-service.ts b/backend/src/ee/services/gateway/gateway-service.ts
index 560adc444..44f48b574 100644
--- a/backend/src/ee/services/gateway/gateway-service.ts
+++ b/backend/src/ee/services/gateway/gateway-service.ts
@@ -353,7 +353,7 @@ export const gatewayServiceFactory = ({
       ),
       new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true),
       // san
-      new x509.SubjectAlternativeNameExtension([{ type: "ip", value: "127.0.0.1" }], false)
+      new x509.SubjectAlternativeNameExtension([{ type: "ip", value: relayAddress.split(":")[0] }], false)
     ];
 
     const serialNumber = createSerialNumber();
@@ -374,6 +374,7 @@ export const gatewayServiceFactory = ({
     // just for local development
     const formatedRelayAddress =
       appCfg.NODE_ENV === "development" ? relayAddress.replace("127.0.0.1", "host.docker.internal") : relayAddress;
+
     await gatewayDAL.transaction(async (tx) => {
       await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.OrgGatewayCertExchange(identityOrg)]);
       const existingGateway = await gatewayDAL.findOne({ identityId, orgGatewayRootCaId: orgGatewayConfig.id });