3 ms·

Single domain SSL certificates don't cost a lot of money or are even free[1] which are ideal for small/personal websites. Won't solve the three problems you lis

by mfwoods 14y ago

Single domain SSL certificates don't cost a lot of money or are even free[1] which are ideal for small/personal websites. Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. [1] StartSSL.com offers free 1 year single domain certificates.

jimktrains2 14y ago
> Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. They why respond? You're missing the point about requiring an IPv4 addy for each cert. That's the big issue.
- klapinat0r 14y ago
  > requiring an IPv4 addy for each cert Why not just offer HTTP and HTTPS on the same IP?
  - zaphoyd 14y ago
    HTTP and HTTPS are served on different ports so using a single IP for both typically isn't an issue. The issue here is that HTTP allows you to host multiple sites from one IP address, whereas HTTPS can only deliver a single certificate per IP address. This requires 1 IP per SSLed hostname. SNI lets you send multiple certificates on one IP, but client support isn't good enough yet. Multi-name certificates work better but can be more expensive.
    - klapinat0r 14y ago
      > but client support isn't good enough yet. I'm aware of SNI (and rely on it myself), but haven't found it to be an issue yet. As far as I can see it's IE < 7 and XP. How big can that market really be? http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers_with_support_for_TLS_server_name_indication.5B5.5D http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers... If it's the "some corporations require IE6" argument, then it sounds like it's a business, and should be able to charge for the extra IP needed. But maybe I'm just horribly modern.
      - X-Istence 14y ago
        Anything using Microsoft's built-in crypto support, will still not work, I have a .NET based application I am supporting on Windows XP which still doesn't support SNI. Also, my sites that I would want to enable would be public sites ... ones that I don't charge for since they are mostly public sites (but I still want to protect credentials for people posting comments and the like). So charging for an extra IP is simply not an option.

by mfwoods 14y ago

jimktrains2 14y ago

> Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. They why respond? You're missing the point about requiring an IPv4 addy for each cert. That's the big issue.

klapinat0r 14y ago
> requiring an IPv4 addy for each cert Why not just offer HTTP and HTTPS on the same IP?
- zaphoyd 14y ago
  HTTP and HTTPS are served on different ports so using a single IP for both typically isn't an issue. The issue here is that HTTP allows you to host multiple sites from one IP address, whereas HTTPS can only deliver a single certificate per IP address. This requires 1 IP per SSLed hostname. SNI lets you send multiple certificates on one IP, but client support isn't good enough yet. Multi-name certificates work better but can be more expensive.
  - klapinat0r 14y ago
    > but client support isn't good enough yet. I'm aware of SNI (and rely on it myself), but haven't found it to be an issue yet. As far as I can see it's IE < 7 and XP. How big can that market really be? http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers_with_support_for_TLS_server_name_indication.5B5.5D http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers... If it's the "some corporations require IE6" argument, then it sounds like it's a business, and should be able to charge for the extra IP needed. But maybe I'm just horribly modern.
    - X-Istence 14y ago
      Anything using Microsoft's built-in crypto support, will still not work, I have a .NET based application I am supporting on Windows XP which still doesn't support SNI. Also, my sites that I would want to enable would be public sites ... ones that I don't charge for since they are mostly public sites (but I still want to protect credentials for people posting comments and the like). So charging for an extra IP is simply not an option.