4 ms·

The biggest problems I personally have with switching to HTTPS only for my sites: 1. I simply don't have enough IPv4 addresses to put each SSL site on its own

The biggest problems I personally have with switching to HTTPS only for my sites: 1. I simply don't have enough IPv4 addresses to put each SSL site on its own IP address, IPv6, sure, bring it on ... but generally if someone has IPv6 connectivity, then they have SNI (see 3) 2. I don't have the money to get a certificate with X amount of domains on it 3. SNI is still not a good idea simply because there exist still a lot of Windows XP clients that are unable to use it. I am not too worried about the extra CPU cycles for the encryption decryption of connections... Currently on my sites I don't have any reason to use SSL, other than that I would like to protect certain resources such that my account username/password for my personal blog don't go across the ether in plain-text. For that I currently use self-signed SSL certs from a personal root that I can trust in the computers I want to trust them in.

mfwoods 14y ago
Single domain SSL certificates don't cost a lot of money or are even free[1] which are ideal for small/personal websites. Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. [1] StartSSL.com offers free 1 year single domain certificates.
- jimktrains2 14y ago
  > Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. They why respond? You're missing the point about requiring an IPv4 addy for each cert. That's the big issue.
  - klapinat0r 14y ago
    > requiring an IPv4 addy for each cert Why not just offer HTTP and HTTPS on the same IP?
    - zaphoyd 14y ago
      HTTP and HTTPS are served on different ports so using a single IP for both typically isn't an issue. The issue here is that HTTP allows you to host multiple sites from one IP address, whereas HTTPS can only deliver a single certificate per IP address. This requires 1 IP per SSLed hostname. SNI lets you send multiple certificates on one IP, but client support isn't good enough yet. Multi-name certificates work better but can be more expensive.
      - klapinat0r 14y ago
        > but client support isn't good enough yet. I'm aware of SNI (and rely on it myself), but haven't found it to be an issue yet. As far as I can see it's IE < 7 and XP. How big can that market really be? http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers_with_support_for_TLS_server_name_indication.5B5.5D http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers... If it's the "some corporations require IE6" argument, then it sounds like it's a business, and should be able to charge for the extra IP needed. But maybe I'm just horribly modern.
        X-Istence 14y ago
        Anything using Microsoft's built-in crypto support, will still not work, I have a .NET based application I am supporting on Windows XP which still doesn't support SNI. Also, my sites that I would want to enable would be public sites ... ones that I don't charge for since they are mostly public sites (but I still want to protect credentials for people posting comments and the like). So charging for an extra IP is simply not an option.
phantomcircuit 14y ago
startcom (startssl.com) offers unlimited multi-domain and wild card certificates for users who have verified their identity. verifying your identity is a once yearly cost of $60 https://startssl.com/?app=39 https://startssl.com/?app=39 no more excuses :)
- X-Istence 14y ago
  Awesome =). That is very much inside my price range.
StavrosK 14y ago
You don't have to have one IP per domain for SSL, I happily put multiple sites on the same IP. nginx supports it very easily.
- zaphoyd 14y ago
  This uses SNI (which as mentioned in the parent lacks support in certain popular old clients, most notably Windows XP)
- nivla 14y ago
  You don't understand, its not the web-server, it is the client's browser that is the issue. Until SNI came out, the handshake was made and validity of the key determined even before the "Host: xyz.com" header was sent in. Without the host header your webserver can't determine which key among the multiple sites it hosts should be used for authentication. The only way so far to support non-modern browsers and to host multiple SSL sites on the same server is to assign one IP per site; the server can use these IP's to lookup the respective keys.
  - StavrosK 14y ago
    I do understand, I just wasn't aware that there are still browsers that don't support SNI. That's too bad.
  - sk5t 14y ago
    You don't have to have SNI to host multiple unrelated SSL'd sites on one IP, given a Subject Alternate Name (SAN) cert and an httpd that accepts such a configuration.
    - X-Istence 14y ago
      Those generally cost a lot of money...

mfwoods 14y ago

Single domain SSL certificates don't cost a lot of money or are even free[1] which are ideal for small/personal websites. Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. [1] StartSSL.com offers free 1 year single domain certificates.

jimktrains2 14y ago
> Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. They why respond? You're missing the point about requiring an IPv4 addy for each cert. That's the big issue.
- klapinat0r 14y ago
  > requiring an IPv4 addy for each cert Why not just offer HTTP and HTTPS on the same IP?
  - zaphoyd 14y ago
    HTTP and HTTPS are served on different ports so using a single IP for both typically isn't an issue. The issue here is that HTTP allows you to host multiple sites from one IP address, whereas HTTPS can only deliver a single certificate per IP address. This requires 1 IP per SSLed hostname. SNI lets you send multiple certificates on one IP, but client support isn't good enough yet. Multi-name certificates work better but can be more expensive.
    - klapinat0r 14y ago
      > but client support isn't good enough yet. I'm aware of SNI (and rely on it myself), but haven't found it to be an issue yet. As far as I can see it's IE < 7 and XP. How big can that market really be? http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers_with_support_for_TLS_server_name_indication.5B5.5D http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers... If it's the "some corporations require IE6" argument, then it sounds like it's a business, and should be able to charge for the extra IP needed. But maybe I'm just horribly modern.
      - X-Istence 14y ago
        Anything using Microsoft's built-in crypto support, will still not work, I have a .NET based application I am supporting on Windows XP which still doesn't support SNI. Also, my sites that I would want to enable would be public sites ... ones that I don't charge for since they are mostly public sites (but I still want to protect credentials for people posting comments and the like). So charging for an extra IP is simply not an option.

phantomcircuit 14y ago

startcom (startssl.com) offers unlimited multi-domain and wild card certificates for users who have verified their identity. verifying your identity is a once yearly cost of $60 https://startssl.com/?app=39 https://startssl.com/?app=39 no more excuses :)

X-Istence 14y ago
Awesome =). That is very much inside my price range.

StavrosK 14y ago

You don't have to have one IP per domain for SSL, I happily put multiple sites on the same IP. nginx supports it very easily.

zaphoyd 14y ago
This uses SNI (which as mentioned in the parent lacks support in certain popular old clients, most notably Windows XP)
nivla 14y ago
You don't understand, its not the web-server, it is the client's browser that is the issue. Until SNI came out, the handshake was made and validity of the key determined even before the "Host: xyz.com" header was sent in. Without the host header your webserver can't determine which key among the multiple sites it hosts should be used for authentication. The only way so far to support non-modern browsers and to host multiple SSL sites on the same server is to assign one IP per site; the server can use these IP's to lookup the respective keys.
- StavrosK 14y ago
  I do understand, I just wasn't aware that there are still browsers that don't support SNI. That's too bad.
- sk5t 14y ago
  You don't have to have SNI to host multiple unrelated SSL'd sites on one IP, given a Subject Alternate Name (SAN) cert and an httpd that accepts such a configuration.
  - X-Istence 14y ago
    Those generally cost a lot of money...