6 ms·

Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

173 points by liquidise 10y ago

caleblloyd 10y ago
This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni http://caniuse.com/#search=sni
- liquidise 10y ago
  (author here) I would have loved to have SNI work. I wrote this article in response to having profound struggles making it work. My iPhone 7's Safari was routinely failing to connect to sites other browsers claimed were fine, when relying on SNI. The day i swapped over to IP-based connections, the problem resolved itself immediately. If there is something i am missing i would love to know what it is.
  - schoen 10y ago
    You might be able to get useful debugging information with tcpdump or wireshark because SNI itself is sent in the clear (prior to the TLS cryptographic key exchange). You could see if the server is doing something different from other servers, or the browser is doing something different from other browsers.
  - mholt 10y ago
    It must have been something else. Even Safari on iOS has supported SNI since iOS 4.0 (2010).
    - ethernetsalad 10y ago
      The only thing I've had SNI fail under (so far) had been Netscape Navigator 3.0 and at that point, does it really matter?
      - simcop2387 10y ago
        IE on Win XP. Or at least anything using the built in crypto stuff. I think firefox will still use it's own. Not sure about chrome.
      - Maakuth 10y ago
        You might be talking about HTTP 1.1 Host header which allows vhosts for plaintext HTTP servers. SNI allows this to happen with TLS (HTTPS, etc.) servers.
  - geofft 10y ago
    Can you get to https://sni.velox.ch/ https://sni.velox.ch/ from your phone? What are the first few lines? In particular, I'm curious if this is a misconfiguration on the server end, or a misconfiguration on the client end. Certain VPNs or malware can break SNI.
  - lobster_johnson 10y ago
    Never had any SNI issues with Safari. Could it be the mobile network provider (which tends to insert things like NATed IPv6 that can cause weirdness), or did it also fail over wifi?
  - smarinov 10y ago
    I have been using precisely Nginx to serve multiple HTTPS domains with certificates from Let's Encrypt since the first few weeks after it came out, so I am not sure why you think it's strictly necessary to assign them separate IP addresses. Generally speaking, there is nothing wrong with that, and it is indeed a somewhat cleaner solution, but it is definitely doable with SNI if one configures their web server appropriately. Check out the IMHO best TLS SNI test website out there (https://sni.velox.ch/ https://sni.velox.ch/) and the Qualys SSL Labs server test (https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/). They may give you a staring point to find out what exactly went wrong with SNI. And the documentation of Nginx, of course.
  - z3t4 10y ago
    older version of wget and Java also doesn't support SNI, for example used in API https callbacks, or Android apps. One trick I use it to load that site (or the most important) first in nginx, because those that doesn't support SNI will use that certificate. Another option, if you don't need encryption, is to allow http.
  - ClashTheBunny 10y ago
    Could you be having issues with ipv6?
- segmondy 10y ago
  There's enough IPv6
- wnevets 10y ago
  That is if you don't care about supporting windows xp users, I certainly don't.
  - profmonocle 10y ago
    And it's not just XP, it's IE on XP, meaning IE 8 or older. SNI works on the most recent Firefox & Chrome for XP.
- pilom 10y ago
  Unfortunately for our ecommerce site this just isn't the at all an option. 3 months ago we analysed our traffic and found that 12% of our desktop traffic didn't support it (Win XP) and about 8% of our mobile traffic didn't support it (Android older than 4.0). I'm not losing 10% of my revenue just so I don't need to get a couple extra IPs from AWS. And even better, AWS doesn't actually charge me for the IPs. Once IPs are priced in line with their scarcity, I'll start caring. Today when I can get them for free? Not worth it.
  - laumars 10y ago
    If you're having to support devices that old then I'd be more worried about how you're going to take payment details on your e-commerce website over a "secure" connection that would fail most PCI DSS vulnerability scans. The security of TLS has come a long long way since XP and so has research into breaking XP-era ciphers.
    - schoen 10y ago
      Deprecation of old stuff is going incredibly slowly even in rich countries (to the intense frustration of a lot of security teams). Check out the incredible true story, told over years on cabfpub, of the attempt to get rid of SHA-1 in TLS authentication. Notably, the attacks that led to experts' recommendation to move away from SHA-1 immediately were published back in 2005. Meanwhile, Microsoft's "effective date of the SHA-1 deprecation" is tomorrow (!), February 14, 2017. https://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-sha1-certificates.aspx#February_TwentySeventeen_Plan https://social.technet.microsoft.com/wiki/contents/articles/... (Let's have a party!) Figuring out how people are going to get upgraded when problems of some sort are discovered (including software vulnerabilities, not just cryptographic protocol issues) is a major security challenge of our day, maybe the biggest information security problem overall in the world.
      - deleted 10y ago
        [deleted]
  - Dylan16807 10y ago
- phil21 10y ago
  Plenty of reason to not use SNI. First off - not everything is a web browser. While browser support for SNI is pretty good these days, other clients are far behind. That random app that connects to your web API has to also support SNI, which means some old PHP library somewhere has to as well. Good luck. That and a surprising number of "regular" clients still seem to have issues with SNI. My numbers are quite dated, but even as recent as 3 years ago it was something like dropping 10% of traffic for a high traffic site I did A/B testing with. I'm guessing the number was even higher, but the client requested we immediately stop the test once it became apparent it was a major reachability issue affecting revenue.
aaronpk 10y ago
The only clients I've had trouble with SNI is Amazon and Apple's Java clients, as well as python2. It's unfortunately still not possible to host a podcast feed with an SNI HTTPS URL in iTunes, nor can you use SNI for Alexa skills. Otherwise, I've been happily using SNI for years now.
- simcop2387 10y ago
  Interesting, those two are very surprising to have issues. Got anything about the alexa skill one?
reefwalkcuts 10y ago
Can I apply this on Heroku hosted app?
cure 10y ago
This article has an incorrect premise. The author should learn about SNI: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
dawnerd 10y ago
Alternately https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...
tzakrajs 10y ago
I use SNI for my Apache Lets Encrypt script. This allows one IP (my home IP) to host many sites easily and monitors changes to sites-enabled to trigger creation of new SAN certificates based on contents of ServerName and ServerAlias. The script also will regenerate certs for sites-enabled every 30 days. See: https://github.com/tzakrajs/cloud-fortress-lets-encrypt https://github.com/tzakrajs/cloud-fortress-lets-encrypt
- tzakrajs 10y ago
  Included is daemontools run script, the script runs in a loop but should it die, you want it to restart. I added supervise command to my /etc/rc.local to make this run when the web server comes up.
- deleted 10y ago
  [deleted]
hawkice 10y ago
I've never had a single problem with hosting multiple https domains using Nginx and Let's Encrypt. This article is somewhat baffling, considering his example of clients that need this is "mobile browsers" but I've used iOS and Android and it works just fine.
- PuffinBlue 10y ago
  Me neither. I guess Cloudflare (to name but one service reliant on SNI) hasn't either... This article is a bit of an unusual response to a problem of a device not working. When a device of mine doesn't work but others do I put it down to there being a problem with my device, not a widely used technology (like SNI). It's an interesting article to read though.
- 65827 10y ago
  I was gonna post this same thing. Nginx is super rad.
WildUtah 10y ago
Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that covers all the domains you use. There's no reason at all to suffer with the setup and security and resource problems of SNI or multiple IPs outside extreme scenarios.
- iDemonix 10y ago
  I was about to comment pretty much all of these points. As soon as I read about multiple IP's I wondered what was going on. I'm starting my own tech blog for similar articles, maybe I'll do a simpler example for my first post.
- bogomipz 10y ago
  Indeed this is what a SAN cert does. From Letsencrypt's FAQ: "Can I get a certificate for multiple domain names (SAN certificates or UCC certificates)? Yes, the same certificate can contain several different names using the Subject Alternative Name (SAN) mechanism. Source: https://letsencrypt.org/docs/faq/ https://letsencrypt.org/docs/faq/
- smarinov 10y ago
  This is a solution if you don't care that anyone looking at the certificate would be able to directly see every single domain that you are hosting as part of your setup. Determined people would be still able to find it out, more or less, despite not having it handy in their web browser under the field for the certificate's Subject Alternative Name. However, there is nothing stopping you from issuing separate certificates for each domain (possibly with subdomains) and configuring your webserver appropriately with SNI. I have been using precisely Nginx to serve multiple HTTPS domains with certificates from Let's Encrypt since the first few weeks after it came out, so I am not sure why OP thinks it's strictly necessary to assign them separate IP addresses. Generally speaking, there is nothing wrong with that, and it is indeed a somewhat cleaner solution, if it wasn't for the IPv4 examples, oh my...
Sektor 10y ago
I've been trying to do this for a couple of weeks. I have no idea what I'm doing and it's been hard to find any help via google. But I finished it last friday. Without multiple external IP addresses. Funny to see this as the top story when I woke up today. But yes, as caleblloyd says, it's 2017. Use SNI. It's not hard, I'd never even heard of nginx or letsencrypt before I started my project.
rnhmjoj 10y ago
On a side note: in NixOS ACME has been integrated into the nginx configuration. To set up a server with TLS you just do security.acme.certs = { "example.com".email = "youremail@address.com"; }; services.nginx = { enable = true; virtualHosts."example.com" = { enableSSL = true; enableACME = true; }; }; This fetches the certificates and set up a service and a timer to periodically renew them.
- schoen 10y ago
  Wow, is their nginx support portable to other OSes? Do you know who has implemented it?
  - rnhmjoj 10y ago
    NixOS modules are built around Nix and systemd so theoretically you could write a port for a different GNU/Linux distribution if you have those available. I'm not aware of any though. There is however a variant for Darwin based on launchd: https://github.com/LnL7/nix-darwin https://github.com/LnL7/nix-darwin You can find the implementation of the nginx service here: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/nginx/default.nix https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/s...
    - schoen 10y ago
      Thanks, I'd like the people working on nginx integration for certbot to see this!
ufmace 10y ago
Interested to read this and the comments here, as I was just poking around with doing just that. I hadn't been planning on using a second IP address for it, and now I'm wondering how well it will work without it.
zwetan 10y ago
"This means you cannot have multiple HTTPS sites hosted from the same IP address." Is that some kind of joke? Yes you can, unless you want to support very old browsers [0] which would defeat the whole purpose of using SSL/TLS in the first place. Maybe have a look at Mozilla Security/Server Side TLS [1] Also SSL certs are issued for FQDN, not IP addresses (unless the IP is public and owned but still it is considered deprecated now [2]). [0]: https://blogs.msdn.microsoft.com/ieinternals/2009/12/07/understanding-certificate-name-mismatches/ https://blogs.msdn.microsoft.com/ieinternals/2009/12/07/unde... [1]: https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS [2]: https://www.digicert.com/internal-names.htm https://www.digicert.com/internal-names.htm
- ClashTheBunny 10y ago
  The article explains that SNI isn't working: > But while this is widely supported, it is not supported ubiquitously. I've personally had a hell of a time fighting with mobile browsers when relying on SNI. On the other hand, IP addresses are cheap. Like, $1/mo or less, cheap. So buck up and grab an distinct IP for your HTTPS sites. Avoiding the headache of some device/browser combos not working will pay for itself 100 times over.
  - zwetan 10y ago
    So that means you will use pre TLS v1.0 to support those browsers that can not deal with SNI. You must feel very smart to be able to support old Android browsers like Gingerbread which represent 1% of the Android market share [0], and iOS pre v4.0 browsers which represent less than 0,1% of the iOS market share [1]. Now according to TLS/SSL support history of web browsers [2] your server is vulnerable to BEAST, POODLE, CRIME, etc. Congrats your SSL cert is useless. [0]: https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html [1]: https://david-smith.org/iosversionstats/ https://david-smith.org/iosversionstats/ [2]: https://en.wikipedia.org/wiki/Template:TLS/SSL_support_history_of_web_browsers https://en.wikipedia.org/wiki/Template:TLS/SSL_support_histo...
    - 10y ago

173 points by liquidise 10y ago

This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni http://caniuse.com/#search=sni

liquidise 10y ago
(author here) I would have loved to have SNI work. I wrote this article in response to having profound struggles making it work. My iPhone 7's Safari was routinely failing to connect to sites other browsers claimed were fine, when relying on SNI. The day i swapped over to IP-based connections, the problem resolved itself immediately. If there is something i am missing i would love to know what it is.
- schoen 10y ago
  You might be able to get useful debugging information with tcpdump or wireshark because SNI itself is sent in the clear (prior to the TLS cryptographic key exchange). You could see if the server is doing something different from other servers, or the browser is doing something different from other browsers.
- mholt 10y ago
  It must have been something else. Even Safari on iOS has supported SNI since iOS 4.0 (2010).
  - ethernetsalad 10y ago
    The only thing I've had SNI fail under (so far) had been Netscape Navigator 3.0 and at that point, does it really matter?
    - simcop2387 10y ago
      IE on Win XP. Or at least anything using the built in crypto stuff. I think firefox will still use it's own. Not sure about chrome.
    - Maakuth 10y ago
      You might be talking about HTTP 1.1 Host header which allows vhosts for plaintext HTTP servers. SNI allows this to happen with TLS (HTTPS, etc.) servers.
- geofft 10y ago
  Can you get to https://sni.velox.ch/ https://sni.velox.ch/ from your phone? What are the first few lines? In particular, I'm curious if this is a misconfiguration on the server end, or a misconfiguration on the client end. Certain VPNs or malware can break SNI.
- lobster_johnson 10y ago
  Never had any SNI issues with Safari. Could it be the mobile network provider (which tends to insert things like NATed IPv6 that can cause weirdness), or did it also fail over wifi?
- smarinov 10y ago
  I have been using precisely Nginx to serve multiple HTTPS domains with certificates from Let's Encrypt since the first few weeks after it came out, so I am not sure why you think it's strictly necessary to assign them separate IP addresses. Generally speaking, there is nothing wrong with that, and it is indeed a somewhat cleaner solution, but it is definitely doable with SNI if one configures their web server appropriately. Check out the IMHO best TLS SNI test website out there (https://sni.velox.ch/ https://sni.velox.ch/) and the Qualys SSL Labs server test (https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/). They may give you a staring point to find out what exactly went wrong with SNI. And the documentation of Nginx, of course.
- z3t4 10y ago
  older version of wget and Java also doesn't support SNI, for example used in API https callbacks, or Android apps. One trick I use it to load that site (or the most important) first in nginx, because those that doesn't support SNI will use that certificate. Another option, if you don't need encryption, is to allow http.
- ClashTheBunny 10y ago
  Could you be having issues with ipv6?
segmondy 10y ago
There's enough IPv6
wnevets 10y ago
That is if you don't care about supporting windows xp users, I certainly don't.
- profmonocle 10y ago
  And it's not just XP, it's IE on XP, meaning IE 8 or older. SNI works on the most recent Firefox & Chrome for XP.
pilom 10y ago
Unfortunately for our ecommerce site this just isn't the at all an option. 3 months ago we analysed our traffic and found that 12% of our desktop traffic didn't support it (Win XP) and about 8% of our mobile traffic didn't support it (Android older than 4.0). I'm not losing 10% of my revenue just so I don't need to get a couple extra IPs from AWS. And even better, AWS doesn't actually charge me for the IPs. Once IPs are priced in line with their scarcity, I'll start caring. Today when I can get them for free? Not worth it.
- laumars 10y ago
  If you're having to support devices that old then I'd be more worried about how you're going to take payment details on your e-commerce website over a "secure" connection that would fail most PCI DSS vulnerability scans. The security of TLS has come a long long way since XP and so has research into breaking XP-era ciphers.
  - schoen 10y ago
    Deprecation of old stuff is going incredibly slowly even in rich countries (to the intense frustration of a lot of security teams). Check out the incredible true story, told over years on cabfpub, of the attempt to get rid of SHA-1 in TLS authentication. Notably, the attacks that led to experts' recommendation to move away from SHA-1 immediately were published back in 2005. Meanwhile, Microsoft's "effective date of the SHA-1 deprecation" is tomorrow (!), February 14, 2017. https://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-sha1-certificates.aspx#February_TwentySeventeen_Plan https://social.technet.microsoft.com/wiki/contents/articles/... (Let's have a party!) Figuring out how people are going to get upgraded when problems of some sort are discovered (including software vulnerabilities, not just cryptographic protocol issues) is a major security challenge of our day, maybe the biggest information security problem overall in the world.
    - deleted 10y ago
      [deleted]
- Dylan16807 10y ago
phil21 10y ago
Plenty of reason to not use SNI. First off - not everything is a web browser. While browser support for SNI is pretty good these days, other clients are far behind. That random app that connects to your web API has to also support SNI, which means some old PHP library somewhere has to as well. Good luck. That and a surprising number of "regular" clients still seem to have issues with SNI. My numbers are quite dated, but even as recent as 3 years ago it was something like dropping 10% of traffic for a high traffic site I did A/B testing with. I'm guessing the number was even higher, but the client requested we immediately stop the test once it became apparent it was a major reachability issue affecting revenue.

aaronpk 10y ago

The only clients I've had trouble with SNI is Amazon and Apple's Java clients, as well as python2. It's unfortunately still not possible to host a podcast feed with an SNI HTTPS URL in iTunes, nor can you use SNI for Alexa skills. Otherwise, I've been happily using SNI for years now.

simcop2387 10y ago
Interesting, those two are very surprising to have issues. Got anything about the alexa skill one?

reefwalkcuts 10y ago

Can I apply this on Heroku hosted app?

cure 10y ago

This article has an incorrect premise. The author should learn about SNI: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication

dawnerd 10y ago

Alternately https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...

tzakrajs 10y ago

I use SNI for my Apache Lets Encrypt script. This allows one IP (my home IP) to host many sites easily and monitors changes to sites-enabled to trigger creation of new SAN certificates based on contents of ServerName and ServerAlias. The script also will regenerate certs for sites-enabled every 30 days. See: https://github.com/tzakrajs/cloud-fortress-lets-encrypt https://github.com/tzakrajs/cloud-fortress-lets-encrypt

tzakrajs 10y ago
Included is daemontools run script, the script runs in a loop but should it die, you want it to restart. I added supervise command to my /etc/rc.local to make this run when the web server comes up.
deleted 10y ago
[deleted]

hawkice 10y ago

I've never had a single problem with hosting multiple https domains using Nginx and Let's Encrypt. This article is somewhat baffling, considering his example of clients that need this is "mobile browsers" but I've used iOS and Android and it works just fine.

PuffinBlue 10y ago
Me neither. I guess Cloudflare (to name but one service reliant on SNI) hasn't either... This article is a bit of an unusual response to a problem of a device not working. When a device of mine doesn't work but others do I put it down to there being a problem with my device, not a widely used technology (like SNI). It's an interesting article to read though.
65827 10y ago
I was gonna post this same thing. Nginx is super rad.

WildUtah 10y ago

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that covers all the domains you use. There's no reason at all to suffer with the setup and security and resource problems of SNI or multiple IPs outside extreme scenarios.

iDemonix 10y ago
I was about to comment pretty much all of these points. As soon as I read about multiple IP's I wondered what was going on. I'm starting my own tech blog for similar articles, maybe I'll do a simpler example for my first post.
bogomipz 10y ago
Indeed this is what a SAN cert does. From Letsencrypt's FAQ: "Can I get a certificate for multiple domain names (SAN certificates or UCC certificates)? Yes, the same certificate can contain several different names using the Subject Alternative Name (SAN) mechanism. Source: https://letsencrypt.org/docs/faq/ https://letsencrypt.org/docs/faq/
smarinov 10y ago
This is a solution if you don't care that anyone looking at the certificate would be able to directly see every single domain that you are hosting as part of your setup. Determined people would be still able to find it out, more or less, despite not having it handy in their web browser under the field for the certificate's Subject Alternative Name. However, there is nothing stopping you from issuing separate certificates for each domain (possibly with subdomains) and configuring your webserver appropriately with SNI. I have been using precisely Nginx to serve multiple HTTPS domains with certificates from Let's Encrypt since the first few weeks after it came out, so I am not sure why OP thinks it's strictly necessary to assign them separate IP addresses. Generally speaking, there is nothing wrong with that, and it is indeed a somewhat cleaner solution, if it wasn't for the IPv4 examples, oh my...

Sektor 10y ago

I've been trying to do this for a couple of weeks. I have no idea what I'm doing and it's been hard to find any help via google. But I finished it last friday. Without multiple external IP addresses. Funny to see this as the top story when I woke up today. But yes, as caleblloyd says, it's 2017. Use SNI. It's not hard, I'd never even heard of nginx or letsencrypt before I started my project.

rnhmjoj 10y ago

On a side note: in NixOS ACME has been integrated into the nginx configuration. To set up a server with TLS you just do security.acme.certs = { "example.com".email = "youremail@address.com"; }; services.nginx = { enable = true; virtualHosts."example.com" = { enableSSL = true; enableACME = true; }; }; This fetches the certificates and set up a service and a timer to periodically renew them.

schoen 10y ago
Wow, is their nginx support portable to other OSes? Do you know who has implemented it?
- rnhmjoj 10y ago
  NixOS modules are built around Nix and systemd so theoretically you could write a port for a different GNU/Linux distribution if you have those available. I'm not aware of any though. There is however a variant for Darwin based on launchd: https://github.com/LnL7/nix-darwin https://github.com/LnL7/nix-darwin You can find the implementation of the nginx service here: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/nginx/default.nix https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/s...
  - schoen 10y ago
    Thanks, I'd like the people working on nginx integration for certbot to see this!

ufmace 10y ago

Interested to read this and the comments here, as I was just poking around with doing just that. I hadn't been planning on using a second IP address for it, and now I'm wondering how well it will work without it.

zwetan 10y ago

"This means you cannot have multiple HTTPS sites hosted from the same IP address." Is that some kind of joke? Yes you can, unless you want to support very old browsers [0] which would defeat the whole purpose of using SSL/TLS in the first place. Maybe have a look at Mozilla Security/Server Side TLS [1] Also SSL certs are issued for FQDN, not IP addresses (unless the IP is public and owned but still it is considered deprecated now [2]). [0]: https://blogs.msdn.microsoft.com/ieinternals/2009/12/07/understanding-certificate-name-mismatches/ https://blogs.msdn.microsoft.com/ieinternals/2009/12/07/unde... [1]: https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS [2]: https://www.digicert.com/internal-names.htm https://www.digicert.com/internal-names.htm

ClashTheBunny 10y ago
The article explains that SNI isn't working: > But while this is widely supported, it is not supported ubiquitously. I've personally had a hell of a time fighting with mobile browsers when relying on SNI. On the other hand, IP addresses are cheap. Like, $1/mo or less, cheap. So buck up and grab an distinct IP for your HTTPS sites. Avoiding the headache of some device/browser combos not working will pay for itself 100 times over.
- zwetan 10y ago
  So that means you will use pre TLS v1.0 to support those browsers that can not deal with SNI. You must feel very smart to be able to support old Android browsers like Gingerbread which represent 1% of the Android market share [0], and iOS pre v4.0 browsers which represent less than 0,1% of the iOS market share [1]. Now according to TLS/SSL support history of web browsers [2] your server is vulnerable to BEAST, POODLE, CRIME, etc. Congrats your SSL cert is useless. [0]: https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html [1]: https://david-smith.org/iosversionstats/ https://david-smith.org/iosversionstats/ [2]: https://en.wikipedia.org/wiki/Template:TLS/SSL_support_history_of_web_browsers https://en.wikipedia.org/wiki/Template:TLS/SSL_support_histo...
  - 10y ago