2 ms·

I don't think you can get away with using Cloudflare's free SSL. I tried, and I had no real excuse when some users said it didn't work for their old browsers a

I don't think you can get away with using Cloudflare's free SSL. I tried, and I had no real excuse when some users said it didn't work for their old browsers at work. So I paid the $20/mo which made it work in all browsers and had other features that were useful to me, like on the fly image transcoding for mobile devices. If you're really on a shoestring budget, I have a hard time justifying shutting down legit users. Just use something else like Lets Encrypt.

ameliaquining 9y ago
The issue you ran into is not specific to Cloudflare; in particular, Let's Encrypt will not help you work around it. The problem is that ancient (pre-2006) versions of the TLS protocol provided no way for the client to tell the server, before authenticating, which hostname it wanted to talk to. So there could be only one certificate (and therefore, in practice, no more than 100 hostnames) per IP address, which made the use of HTTPS on shared hosting impossible. If you wanted HTTPS, you had to get your own static IP, which is what costs $20 per month (and you can't get it that much cheaper anywhere else). Server Name Indication is a newer extension to the TLS protocol which solves this problem by letting the client specify, when initiating the negotiation, which hostname it wants to talk to. So HTTPS on shared hosting is now possible...unless you need to support truly ancient clients (most notably Windows XP) that are stuck with outdated TLS implementations that don't support SNI. Considering that XP doesn't even get security fixes anymore, and pretty much all clients newer than Windows Vista support SNI now, and running software that old is really not safe (Vista doesn't get security fixes anymore either), I don't think I'd have any qualms about telling those users that they need to upgrade.

2 ms·

I don't think you can get away with using Cloudflare's free SSL. I tried, and I had no real excuse when some users said it didn't work for their old browsers a

by always_good 9y ago

ameliaquining 9y ago
The issue you ran into is not specific to Cloudflare; in particular, Let's Encrypt will not help you work around it. The problem is that ancient (pre-2006) versions of the TLS protocol provided no way for the client to tell the server, before authenticating, which hostname it wanted to talk to. So there could be only one certificate (and therefore, in practice, no more than 100 hostnames) per IP address, which made the use of HTTPS on shared hosting impossible. If you wanted HTTPS, you had to get your own static IP, which is what costs $20 per month (and you can't get it that much cheaper anywhere else). Server Name Indication is a newer extension to the TLS protocol which solves this problem by letting the client specify, when initiating the negotiation, which hostname it wants to talk to. So HTTPS on shared hosting is now possible...unless you need to support truly ancient clients (most notably Windows XP) that are stuck with outdated TLS implementations that don't support SNI. Considering that XP doesn't even get security fixes anymore, and pretty much all clients newer than Windows Vista support SNI now, and running software that old is really not safe (Vista doesn't get security fixes anymore either), I don't think I'd have any qualms about telling those users that they need to upgrade.