4 ms·
I'm struggling to think of a browser that supports SHA-2 TLS encryption, and doesn't support SNI, which one am I missing?
by EwanToo 11y ago
I'm struggling to think of a browser that supports SHA-2 TLS encryption, and doesn't support SNI, which one am I missing?
- 0x0 11y agoWindows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.
- jhkaghjkga 11y agoThat's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.
- 0x0 11y agoThat's quite limiting if you are handling customer signups, and it still breaks SNI-less clients except for the first batch.
- Tepix 11y agoWindows XP and Android 2.x both have big security problems. You should encourage your users to upgrade. Also I think with Firefox on Windows XP it should work.
- 0x0 11y agoThat doesn't help when you are targeting a market where Android 2.x is prevalent.
- Tepix 11y agoTrue. Is there no workaround for Android 2.x? What if you install a 3rd party browser?
- 0x0 11y agoYou'd probably have to bring your own SSL stack, which is not something you'd want to do for several reasons (staying on top of code patches, maintaining a CA root store, integrating any custom CA roots the user has added, handling any custom HTTP proxy settings, etc).