4 ms·

If your site is much bigger than a personal blog, turning on SSL by default will cost you a a fortune. Your hosting bill will be virtually unchanged, but the C

by hapless 14y ago

If your site is much bigger than a personal blog, turning on SSL by default will cost you a a fortune. Your hosting bill will be virtually unchanged, but the CDN costs are ruinous. Akamai charges about 10x as much for custom SSL service as for regular. Amazon Cloudfront just won't do custom SSL -- you have to use their domain and risk ugly browser warnings. I don't know about other CDNs, but given the nature of the technology, I expect their cost structures to be similar. (over 40% of clients do not support SNI, so each custom SSL certificate requires a dedicated TCP port, which drives up costs for the CDN. Worse, a lot of clients will reject ports other than 443, forcing you to use a separate IP for each custom certificate.)

deleted 14y ago
[deleted]
jgrahamc 14y ago
You could always use any CloudFlare paid account. They include SSL and you get all the security/CDN stuff as well: http://blog.cloudflare.com/easiest-ssl-ever-now-included-automatically-w http://blog.cloudflare.com/easiest-ssl-ever-now-included-aut...
- hapless 14y ago
  If you read the comments, the cloudflare guys mention that, like Amazon CloudFront, it is not yet possible to use your own certificate. That means their cost is essentially zero (some CPU time or an SSL accelerator card). They can serve every request from the same endpoint. It also means their SSL service is useless for CDN because it will induce warnings in the browser. (You may be able to evade the warnings if you add their custom domain as a SAN on your primary certificate, but I've never tried it, so I cannot speak with certainty to the outcome)
  - Titanous 14y ago
    CloudFlare actually does do SSL for your domain without warnings or SNI. They essentially have a large pool of shared certificates with lots of SANs, so your domain ends up as a SAN on one of their shared certificates with half a dozen other CloudFlare customers.
blablabla123 14y ago
Given you really need a CDN, the hosting will cost you a fortune anyway... ;)
cma 14y ago
It would be nice if you could have a cryptographic hash on img and other tags, so that when the main page is in https, CDN content could be loaded iff it matches the hash.
- graue 14y ago
  That doesn't give you privacy though because the content can still be intercepted and spied on.

by hapless 14y ago

deleted 14y ago

[deleted]

jgrahamc 14y ago

You could always use any CloudFlare paid account. They include SSL and you get all the security/CDN stuff as well: http://blog.cloudflare.com/easiest-ssl-ever-now-included-automatically-w http://blog.cloudflare.com/easiest-ssl-ever-now-included-aut...

hapless 14y ago
If you read the comments, the cloudflare guys mention that, like Amazon CloudFront, it is not yet possible to use your own certificate. That means their cost is essentially zero (some CPU time or an SSL accelerator card). They can serve every request from the same endpoint. It also means their SSL service is useless for CDN because it will induce warnings in the browser. (You may be able to evade the warnings if you add their custom domain as a SAN on your primary certificate, but I've never tried it, so I cannot speak with certainty to the outcome)
- Titanous 14y ago
  CloudFlare actually does do SSL for your domain without warnings or SNI. They essentially have a large pool of shared certificates with lots of SANs, so your domain ends up as a SAN on one of their shared certificates with half a dozen other CloudFlare customers.

blablabla123 14y ago

Given you really need a CDN, the hosting will cost you a fortune anyway... ;)

cma 14y ago

It would be nice if you could have a cryptographic hash on img and other tags, so that when the main page is in https, CDN content could be loaded iff it matches the hash.

graue 14y ago
That doesn't give you privacy though because the content can still be intercepted and spied on.