6 ms·
an annoying thing about HTTPS is that it requires you to serve each domain name from a separate IP address, and that can be somewhat costly.
by jes5199 14y ago
an annoying thing about HTTPS is that it requires you to serve each domain name from a separate IP address, and that can be somewhat costly.
- theatrus2 14y agoIf you ignore IE+Windows XP, you can safely use SNI.
- micro-ram 14y agoI would love to...Who's with me? Anyone? Anyone? Bueller?
- cdjk 14y agoAlas, while I feel comfortable not XB testing WinXP because it's less than 1% of users (or whatever threshold you want), I'm not quite as comfortable using that argument with SSL certs. Unfortunately the two solutions (SNI and IPv6) are unlikely to work on XP, so the only hope is to wait until all those computers are replaced or upgraded.
- kelnos 14y ago... and the stock Android browser, IIRC.
- dkulchenko 14y agoFixed since 3.x: https://code.google.com/p/android/issues/detail?id=12908#c13 https://code.google.com/p/android/issues/detail?id=12908#c13
- fpgeek 14y agoTrue, but just like XP, there are lots of pre-3.x devices out there...
- giovannibajo1 14y agoThat would be approximately 50% of them, btw.
- pilif 14y agoIt's any browser on XP which uses the Windows Crypto API, most notably probably the second most used browser, Chrome. As long as XP is around, we're going to need One IP address per domain if we want to do SSL.
- pmh 14y agoChrome 6+ appears to support SNI on XP [1] https://code.google.com/p/chromium/issues/detail?id=43142 https://code.google.com/p/chromium/issues/detail?id=43142 [2] http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers_with_support_for_TLS_server_name_indication.5B6.5D http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers...
- stephen_g 14y agoThis is why widespread IPv6 can't come soon enough. You can give whole subnets to each subdomain if you feel like it, without paying a cent...
- SEJeff 14y agoSNI has been out for a long time. Windows XP with IE < 8 doesnt support it, but at this point, Microsoft has practically abandoned it so it seems reasonable to let those users suffer and tell them to use Firefox/Chrome.
- yuhong 14y ago>Windows XP with IE <= 8 FTFY.
- justincormack 14y agoWhat does the message they see say? Presumably invalid cert before you get to being able to say anything. Its OK if you just have part of site HTTPS but difficult if it all is?
- onemorepassword 14y agoNo it doesn't. You can use multi-domain certificates. Works like a charm. Also, I talked to GlobalSign recently, and they had a brand new solution that used SNI with an automatic fallback to multi-domain certificate for browsers that don't support SNI.
- jes5199 14y agomulti-domain certs are brittle, because you have to keep them up to date with all the domains you're serving.
- onemorepassword 14y agoThat doesn't make them brittle, it does make updating them a potential single point of failure. But that goes for multiple things if you're working from one single IP address, so accounting for those is part of the tradeoff.