4 ms·

While we're dispelling SSL myths, let me add the reminder that SSL does encrypt the URL and querystring and HTTP headers. It doesn't look like it in browsers b

by T-hawk 13y ago

While we're dispelling SSL myths, let me add the reminder that SSL does encrypt the URL and querystring and HTTP headers. It doesn't look like it in browsers because they still show the URL cleartext onscreen, but over the wire all of that is indeed inside the encryption envelope. Only the destination IP address isn't encrypted.

buro9 13y ago
And whilst we're still here... SNI and SSL. Thanks to Internet Explorer, and the early versions of the stock browser on Android, you will need a unique IPv4 address for your SSL endpoint. You cannot safely serve multiple SSL sites on the same IP.✝ Basically: The hostname is also encrypted, so the SSL requests on some browsers require a unique IPv4 address. Your provider will give you one if you say the magic word "SSL" to them. ✝There are ways for most browsers, but not for IE and early Android browsers. Thankfully mobile device churn will cure us of the Android issue, but the affected IE versions will take longer to die.
- diminoten 13y ago
  Huh, TIL. What was the reasoning behind this?
  - veesahni 13y ago
    When client connects to server, first it does the SSL handshake. Then it sends HTTP headers. As a result, SSL really has nothing to do with HTTP and could be used to wrap other protocols. Check out stunnel ( https://www.stunnel.org/index.html https://www.stunnel.org/index.html ) which can be used to arbitrarily encrypt communications for any TCP based protocol
    - mcguire 13y ago
      And one of the first parts of the SSL handshake is for the server to send the certificate to the client, so the server has to know which certificate to send based only on the IP address that the client is connecting to. The client then verifies that the certificate matches the host name it's trying to connect to. Then it sends the Host: header with the request. It's a strict layering: TCP - SSL ("Secure Socket Layer", right?) - HTTP There are two (and a half) ways of using a SSL certificate for multiple hostnames on the same IP address / interface: SNI (Server Name Identification (?)) and Subject Alt Names or Wildcard certificates. SNI extends the SSL protocol to send the hostname during the client handshake. The Subject Alt Name extension, which has been more reliable and available for me, adds multiple hostnames to the certificate for the client to match against. Wildcards do the same thing, patternistically: *.example.com.
  - buro9 13y ago
    Who knows. I prefer to focus on what needs to be done to make things work.
- jerdfelt 13y ago
  Internet Explorer does support SNI since IE7. However Windows XP doesn't even if running IE7 or newer. That said, we're on our way to a bright SNI filled future, we just have to get over the hump of old versions of Windows and some old mobile devices before it's common enough to be used reliably.

by T-hawk 13y ago

buro9 13y ago

And whilst we're still here... SNI and SSL. Thanks to Internet Explorer, and the early versions of the stock browser on Android, you will need a unique IPv4 address for your SSL endpoint. You cannot safely serve multiple SSL sites on the same IP.✝ Basically: The hostname is also encrypted, so the SSL requests on some browsers require a unique IPv4 address. Your provider will give you one if you say the magic word "SSL" to them. ✝There are ways for most browsers, but not for IE and early Android browsers. Thankfully mobile device churn will cure us of the Android issue, but the affected IE versions will take longer to die.

diminoten 13y ago
Huh, TIL. What was the reasoning behind this?
- veesahni 13y ago
  When client connects to server, first it does the SSL handshake. Then it sends HTTP headers. As a result, SSL really has nothing to do with HTTP and could be used to wrap other protocols. Check out stunnel ( https://www.stunnel.org/index.html https://www.stunnel.org/index.html ) which can be used to arbitrarily encrypt communications for any TCP based protocol
  - mcguire 13y ago
    And one of the first parts of the SSL handshake is for the server to send the certificate to the client, so the server has to know which certificate to send based only on the IP address that the client is connecting to. The client then verifies that the certificate matches the host name it's trying to connect to. Then it sends the Host: header with the request. It's a strict layering: TCP - SSL ("Secure Socket Layer", right?) - HTTP There are two (and a half) ways of using a SSL certificate for multiple hostnames on the same IP address / interface: SNI (Server Name Identification (?)) and Subject Alt Names or Wildcard certificates. SNI extends the SSL protocol to send the hostname during the client handshake. The Subject Alt Name extension, which has been more reliable and available for me, adds multiple hostnames to the certificate for the client to match against. Wildcards do the same thing, patternistically: *.example.com.
- buro9 13y ago
  Who knows. I prefer to focus on what needs to be done to make things work.
jerdfelt 13y ago
Internet Explorer does support SNI since IE7. However Windows XP doesn't even if running IE7 or newer. That said, we're on our way to a bright SNI filled future, we just have to get over the hump of old versions of Windows and some old mobile devices before it's common enough to be used reliably.