4 ms·

> Perhaps the main reason most of us are not using HTTPS to serve our websites is simply that it doesn't work with virtual hosts. That's a bit confusing. They

by mopoke 16y ago

> Perhaps the main reason most of us are not using HTTPS to serve our websites is simply that it doesn't work with virtual hosts. That's a bit confusing. They mean when multiple sites share the same public IP. You can run SSL on a "virtual host" (i.e. a host running as a VM rather than on bare metal). Also not mentioned is the general increase in server load by having to encrypt/decrypt all traffic. (or the additional cost of investing in a dedicated layer to do that for you).

jedsmith 16y ago
> "virtual host" (i.e. a host running as a VM rather than on bare metal). That isn't what virtual host means, particularly not here. Your "they mean ___" is exactly what virtual host means. http://en.wikipedia.org/wiki/Virtual_hosting http://en.wikipedia.org/wiki/Virtual_hosting > Also not mentioned is the general increase in server load by having to encrypt/decrypt all traffic. Because it's fairly negligible, especially with OpenSSL able to take advantage of AES-NI and equivalents. Most of the hit you see is setting up a connection. You can move SSL off your app stack and onto load balancers, too, and it's wise to do so.
streeter 16y ago
It is actually possible to serve multiple virtual hosts from the same IP (http://en.wikipedia.org/wiki/Server_Name_Indication#The_fix http://en.wikipedia.org/wiki/Server_Name_Indication#The_fix). The first technique is called Sever Name Indication, which is a way to specify a virtual host with TLS (https) negotiations by sending the virtual domain as part of the TLS negotiation The second method is a specification that introduces the subjectAltName field which allows one cert to be used across multiple subdomains (for things like wildcarding). This would make it really easy to do organization-based subdomains with TLS encryption. There are limits to which browsers and which servers can do it. It requires IE7 and up (not on XP though), and basically all recent versions of other browsers. Edit: noted that IE on XP doesn't work.
- duskwuff 16y ago
  SNI doesn't work in IE7 (or IE8) if you're running Windows XP. This ends up leaving a sizable chunk of users unable to use it.

by mopoke 16y ago

jedsmith 16y ago

> "virtual host" (i.e. a host running as a VM rather than on bare metal). That isn't what virtual host means, particularly not here. Your "they mean ___" is exactly what virtual host means. http://en.wikipedia.org/wiki/Virtual_hosting http://en.wikipedia.org/wiki/Virtual_hosting > Also not mentioned is the general increase in server load by having to encrypt/decrypt all traffic. Because it's fairly negligible, especially with OpenSSL able to take advantage of AES-NI and equivalents. Most of the hit you see is setting up a connection. You can move SSL off your app stack and onto load balancers, too, and it's wise to do so.

streeter 16y ago

It is actually possible to serve multiple virtual hosts from the same IP (http://en.wikipedia.org/wiki/Server_Name_Indication#The_fix http://en.wikipedia.org/wiki/Server_Name_Indication#The_fix). The first technique is called Sever Name Indication, which is a way to specify a virtual host with TLS (https) negotiations by sending the virtual domain as part of the TLS negotiation The second method is a specification that introduces the subjectAltName field which allows one cert to be used across multiple subdomains (for things like wildcarding). This would make it really easy to do organization-based subdomains with TLS encryption. There are limits to which browsers and which servers can do it. It requires IE7 and up (not on XP though), and basically all recent versions of other browsers. Edit: noted that IE on XP doesn't work.

duskwuff 16y ago
SNI doesn't work in IE7 (or IE8) if you're running Windows XP. This ends up leaving a sizable chunk of users unable to use it.