3 ms·
Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded
by 0x0 11y ago
Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI.
But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.
- jhkaghjkga 11y agoThat's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.
- 0x0 11y agoThat's quite limiting if you are handling customer signups, and it still breaks SNI-less clients except for the first batch.
- Tepix 11y agoWindows XP and Android 2.x both have big security problems. You should encourage your users to upgrade. Also I think with Firefox on Windows XP it should work.
- 0x0 11y agoThat doesn't help when you are targeting a market where Android 2.x is prevalent.
- Tepix 11y agoTrue. Is there no workaround for Android 2.x? What if you install a 3rd party browser?
- 0x0 11y agoYou'd probably have to bring your own SSL stack, which is not something you'd want to do for several reasons (staying on top of code patches, maintaining a CA root store, integrating any custom CA roots the user has added, handling any custom HTTP proxy settings, etc).