4 ms·

Extra cost of a static IP hosting (needed for domain registration) is a big factor, doubles the costs of my small website hosting.

finnn 9y ago
Domain registration? That certainly doesn't require a static IP... nor does any other part of deploying TLS.
throwaway2048 9y ago
https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication Any host that still requires a dedicated IP for https is woefully out of date.
- mjevans 9y ago
  It's sadly not just the servers but also the clients... still you're right about that being a really long tail at this point. Edit: A quick search seems to indicate that the only typical consumer facing system that doesn't support SNI is IE on Windows XP. It's pretty safe to have a catch-all bucket that informs such users to use a modern, security patches including browser or to upgrade to a different OS.
  - throwaway2048 9y ago
    Anything that cant do SNI isn't going to support TLS 1.1+ and wont be able to access a huge percentage of the web anyways. Eventually old clients have to be let go of, maintaining compatibility for them degrades everyone else's security.
    - kvz 9y ago
      Unless you support both via e.g. https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SHA1/SHA256-certificate-switching-with-HAProxy https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SH...
- LarryMade2 9y ago
  > Any host that still requires a dedicated IP for https is woefully out of date. May be true in a perfect world but this is my web host (bluehost): >> Note: Since SSL Certificates are Domain/IP specific, you must first Purchase a Dedicated IP before purchasing or having an SSL Certificate installed on your account. They will NOT work with a shared IP address. I'm pretty sure a lot of other hosting services still go that route.
  - throwaway2048 9y ago
    At this point SNI is 10+ years old, hard to have much sympathy for a company that has sat on things that long.
  - syncsynchalt 9y ago
    Bluehost Brasil supports SNI - http://cp.br.bluehost.com/kb/answer/2643 http://cp.br.bluehost.com/kb/answer/2643 Bluehost US doesn't seem to, as you indicate - https://my.bluehost.com/cgi/help/473 https://my.bluehost.com/cgi/help/473 I'm not sure whether they just don't support SNI yet, or whether they are artificially enforcing this restriction so that they don't have to deal with IE6 not working.

finnn 9y ago

Domain registration? That certainly doesn't require a static IP... nor does any other part of deploying TLS.

throwaway2048 9y ago

https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication Any host that still requires a dedicated IP for https is woefully out of date.

mjevans 9y ago
It's sadly not just the servers but also the clients... still you're right about that being a really long tail at this point. Edit: A quick search seems to indicate that the only typical consumer facing system that doesn't support SNI is IE on Windows XP. It's pretty safe to have a catch-all bucket that informs such users to use a modern, security patches including browser or to upgrade to a different OS.
- throwaway2048 9y ago
  Anything that cant do SNI isn't going to support TLS 1.1+ and wont be able to access a huge percentage of the web anyways. Eventually old clients have to be let go of, maintaining compatibility for them degrades everyone else's security.
  - kvz 9y ago
    Unless you support both via e.g. https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SHA1/SHA256-certificate-switching-with-HAProxy https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SH...
LarryMade2 9y ago
> Any host that still requires a dedicated IP for https is woefully out of date. May be true in a perfect world but this is my web host (bluehost): >> Note: Since SSL Certificates are Domain/IP specific, you must first Purchase a Dedicated IP before purchasing or having an SSL Certificate installed on your account. They will NOT work with a shared IP address. I'm pretty sure a lot of other hosting services still go that route.
- throwaway2048 9y ago
  At this point SNI is 10+ years old, hard to have much sympathy for a company that has sat on things that long.
- syncsynchalt 9y ago
  Bluehost Brasil supports SNI - http://cp.br.bluehost.com/kb/answer/2643 http://cp.br.bluehost.com/kb/answer/2643 Bluehost US doesn't seem to, as you indicate - https://my.bluehost.com/cgi/help/473 https://my.bluehost.com/cgi/help/473 I'm not sure whether they just don't support SNI yet, or whether they are artificially enforcing this restriction so that they don't have to deal with IE6 not working.