6 ms·

That's a fun project. For production websites and blogs, I'm pretty happy with Netlify, CloudFlare, and CloudFront. But CloudFront charges $600 per month for cu

That's a fun project. For production websites and blogs, I'm pretty happy with Netlify, CloudFlare, and CloudFront. But CloudFront charges $600 per month for custom SSL certificates [1], so you could save a lot of money by just spinning up ~10 servers in different AWS regions. I noticed this line at the bottom of the page: "When it comes to picking a solution, I often choose the less traveled road". I don't agree with that at all, and it sounds a bit like NIH syndrome. It's always better to choose the most-traveled roads, especially in DevOps. If there's a problem, then you can join those communities and contribute to the projects. [1] https://aws.amazon.com/cloudfront/custom-ssl-domains/ https://aws.amazon.com/cloudfront/custom-ssl-domains/

koolba 9y ago
If you can get by with only SNI connections then you don’t have to pay the $600 per month. The $600 is for a dedicated IP that will serve a single certificate.
janoszen 9y ago
"When it comes to picking a solution, I often choose the less traveled road" I forgot to add that this applies only to R&D and hobby projects, for production setups I'm a bit more careful. :) (I'm the author.)
- nathan_f77 9y ago
  Ah, that makes sense!
  - janoszen 9y ago
    Thank you for pointing that out, I've updated my bio to reflect that. Hopefully this way it's a little less ambiguous. :)
jgrahamc 9y ago
$600/month for a custom SSL certificate is totally ridiculous. Cloudflare Pro ($20/month) includes a certificate that works with non-SNI browsers.
andrewstuart2 9y ago
The $600/mo figure has to be considered against the type of workload your servers run, and how variable your traffic patterns are. If you need to handle bursty traffic, you're likely going to get best value in shared tenancy services until you can fully utilize your servers. Otherwise, you will probably end up paying for idle infrastructure.
- manigandham 9y ago
  It has nothing to do with workload, that's the price for a dedicated IP to serve a TLS certificate to serve the (rapidly diminishing number of) non-SNI capable browsers and devices.
janoszen 9y ago
I think SNI is fine, all modern browsers seem to support it: https://caniuse.com/#search=sni https://caniuse.com/#search=sni
lostcolony 9y ago
'It's always better to choose the most-traveled roads, especially in DevOps' Maybe. I agree it's not as clearcut as always pick the less traveled road, but the difference between the two may include a competitive advantage that you'd be unwise to overlook. I mean, you're on HN; Paul Graham and Common Lisp back in the 90s is an excellent example.
manigandham 9y ago
That price is only for non-SNI browser and devices, which is probably less than 1% of devices/browsers now [1]. Otherwise Cloudfront supports free custom certificates and you can use Amazon's Certificate Manager to acquire and renew them automatically, also for free. https://www.digicert.com/ssl-support/apache-secure-multiple-sites-sni.htm https://www.digicert.com/ssl-support/apache-secure-multiple-...
homero 9y ago
I use https://www.keycdn.com https://www.keycdn.com which has free letsencrypt
sciurus 9y ago
> But CloudFront charges $600 per month for custom SSL certificates This is misleading. Cloudfront doesn't charge anything for putting your domains on an SSL cert that uses SNI. They only change you if you need a cert without SNI, which requires them to allocate a dedicated IP address to you. I'm hosting my personal blog on S3 and cloudfront, with SSL, for less than a dollar a month. Performance and capabilities are fine for me, too. I get 0.15 seconds to first byte from Chicago, vs 0.24 for the author's site. https://www.webpagetest.org/result/180214_K2_28c2826a6422b01066a8ac8e3eb54ec5/ https://www.webpagetest.org/result/180214_K2_28c2826a6422b01... https://www.webpagetest.org/result/180214_QT_a91f7af3bf78e7bad4bfbe47614e0b4e/ https://www.webpagetest.org/result/180214_QT_a91f7af3bf78e7b...
- janoszen 9y ago
  If you are fine with having slashes at the end of your URLs and you do not want to do anything too complicated like content negotiation for image types, S3 and CloudFront is fine. The moment you turn on Lambda@Edge, to do the magic, things get slow after a period of no traffic. I plan on expanding on the featureset, so no S3 for me. :)
  - gunzel 9y ago
    Did you consider using periodic calls to keep the Lambda@Edge functions "warm"? I've been playing with Zappa (https://www.zappa.io https://www.zappa.io) for standard Lambda and it sets this up by default.
    - janoszen 9y ago
      Yes, but it's kind of a whack-a-mole since their reuse times are not public AFAIK, so it would constantly need tuning as they develop the service.

koolba 9y ago

If you can get by with only SNI connections then you don’t have to pay the $600 per month. The $600 is for a dedicated IP that will serve a single certificate.

janoszen 9y ago

"When it comes to picking a solution, I often choose the less traveled road" I forgot to add that this applies only to R&D and hobby projects, for production setups I'm a bit more careful. :) (I'm the author.)

nathan_f77 9y ago
Ah, that makes sense!
- janoszen 9y ago
  Thank you for pointing that out, I've updated my bio to reflect that. Hopefully this way it's a little less ambiguous. :)

jgrahamc 9y ago

$600/month for a custom SSL certificate is totally ridiculous. Cloudflare Pro ($20/month) includes a certificate that works with non-SNI browsers.

andrewstuart2 9y ago

The $600/mo figure has to be considered against the type of workload your servers run, and how variable your traffic patterns are. If you need to handle bursty traffic, you're likely going to get best value in shared tenancy services until you can fully utilize your servers. Otherwise, you will probably end up paying for idle infrastructure.

manigandham 9y ago
It has nothing to do with workload, that's the price for a dedicated IP to serve a TLS certificate to serve the (rapidly diminishing number of) non-SNI capable browsers and devices.

janoszen 9y ago

I think SNI is fine, all modern browsers seem to support it: https://caniuse.com/#search=sni https://caniuse.com/#search=sni

lostcolony 9y ago

'It's always better to choose the most-traveled roads, especially in DevOps' Maybe. I agree it's not as clearcut as always pick the less traveled road, but the difference between the two may include a competitive advantage that you'd be unwise to overlook. I mean, you're on HN; Paul Graham and Common Lisp back in the 90s is an excellent example.

manigandham 9y ago

That price is only for non-SNI browser and devices, which is probably less than 1% of devices/browsers now [1]. Otherwise Cloudfront supports free custom certificates and you can use Amazon's Certificate Manager to acquire and renew them automatically, also for free. https://www.digicert.com/ssl-support/apache-secure-multiple-sites-sni.htm https://www.digicert.com/ssl-support/apache-secure-multiple-...

homero 9y ago

I use https://www.keycdn.com https://www.keycdn.com which has free letsencrypt

sciurus 9y ago

> But CloudFront charges $600 per month for custom SSL certificates This is misleading. Cloudfront doesn't charge anything for putting your domains on an SSL cert that uses SNI. They only change you if you need a cert without SNI, which requires them to allocate a dedicated IP address to you. I'm hosting my personal blog on S3 and cloudfront, with SSL, for less than a dollar a month. Performance and capabilities are fine for me, too. I get 0.15 seconds to first byte from Chicago, vs 0.24 for the author's site. https://www.webpagetest.org/result/180214_K2_28c2826a6422b01066a8ac8e3eb54ec5/ https://www.webpagetest.org/result/180214_K2_28c2826a6422b01... https://www.webpagetest.org/result/180214_QT_a91f7af3bf78e7bad4bfbe47614e0b4e/ https://www.webpagetest.org/result/180214_QT_a91f7af3bf78e7b...

janoszen 9y ago
If you are fine with having slashes at the end of your URLs and you do not want to do anything too complicated like content negotiation for image types, S3 and CloudFront is fine. The moment you turn on Lambda@Edge, to do the magic, things get slow after a period of no traffic. I plan on expanding on the featureset, so no S3 for me. :)
- gunzel 9y ago
  Did you consider using periodic calls to keep the Lambda@Edge functions "warm"? I've been playing with Zappa (https://www.zappa.io https://www.zappa.io) for standard Lambda and it sets this up by default.
  - janoszen 9y ago
    Yes, but it's kind of a whack-a-mole since their reuse times are not public AFAIK, so it would constantly need tuning as they develop the service.