6 ms·

It is sort of worth noting that it's only free if you have a dedicated IP address. If you just have a cheap hosting plan somewhere, you'll need to pay them for

by kemayo 13y ago

It is sort of worth noting that it's only free if you have a dedicated IP address. If you just have a cheap hosting plan somewhere, you'll need to pay them for said dedicated IP before you can set up SSL, generally. I mean, we're not talking a huge amount of money. Webfaction is $5/month [1]. Still! [1]: https://www.webfaction.com/features https://www.webfaction.com/features

spindritf 13y ago
You can use StartSSL certificates with SNI (Server Name Indication) which allows you to have multiple sites/domains on the same IP. And really, just get a VPS from Digital Ocean -- be the master of your IP, configuration and fate.
- druiid 13y ago
  Only issue with SNI is that it has to be supported by the browser. Generally not an issue these days, but something to be aware of. Edit: Actually, I just looked... WinXP still doesn't support it with IE, so, actually it could be a big issue still.
  - onedognight 13y ago
    It's worse than you suggest. XP doesn't have the StartCom root cert unless the user has installed a manual root cert update.
    - eli 13y ago
      I think the root cert was added through Windows Update a to XP few years ago, so there's a decent chance boxes in the wild have. SNI is still a no-go on XP though.
handsomeransoms 13y ago
Webfaction enabled SNI on all of their servers in December 2011 [1], which means you no longer need to buy a dedicated IP address to use SSL. In fact, when they made this switch, they switched my server over to SNI automatically and stopped charging me the extra $5/month automatically. Awesome! A small fraction of Internet users on extremely out-of-date system cannot use SNI. If you need to support those users, you will still have to buy a dedicated IP address. I personally don't bother (if you're running IE 6 on Windows XP, you have bigger problems). This is a great guide! I did the exact same thing several months ago and am very happy with the result. Enough with the excuses not to deploy SSL! [1] https://blog.webfaction.com/2011/12/server-name-indication-enabled-on-all-servers/ https://blog.webfaction.com/2011/12/server-name-indication-e...
- dangrossman 13y ago
  Almost 1 in 5 people on the web are still running Windows XP. No version of Internet Explorer on XP supports SNI. Neither does Safari on XP, the browser in Android 2.x, the BlackBerry browser or Opera Mobile before 10.1. It may be a minority of users, but it's not just "people who are still running IE6". Pretty much everyone would love to use SNI; site owners wouldn't have to pay for extra IPs, hosting companies wouldn't have to worry about securing and allocating them just for SSL use, tons of IPv4 space could be put back into circulation, and CAs would be able to sell many more certs. Unfortunately the group that can't use it is too large to ignore, so none of that's happening.
  - handsomeransoms 13y ago
    I appreciate your detailed response! I should not have been so dismissive of those users. Still, I maintain that the "extra cost for a dedicated IP" is a poor excuse for not implementing SSL.
    - agwa 13y ago
      Unfortunately. it's not always just the cost - too many providers (e.g. DigitalOcean) obnoxiously don't support multiple IP addresses on a server/VM.
      - jbrechtel 13y ago
        Why's this a problem related to SSL?
        chrismorgan 13y ago
        Without SNI, SSL works on an IP address level rather than a hostname level, just like HTTP/1.0 worked at the IP address level and HTTP/1.1 works at the hostname level with the Host header. Read https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication for more info.

by kemayo 13y ago

spindritf 13y ago

You can use StartSSL certificates with SNI (Server Name Indication) which allows you to have multiple sites/domains on the same IP. And really, just get a VPS from Digital Ocean -- be the master of your IP, configuration and fate.

druiid 13y ago
Only issue with SNI is that it has to be supported by the browser. Generally not an issue these days, but something to be aware of. Edit: Actually, I just looked... WinXP still doesn't support it with IE, so, actually it could be a big issue still.
- onedognight 13y ago
  It's worse than you suggest. XP doesn't have the StartCom root cert unless the user has installed a manual root cert update.
  - eli 13y ago
    I think the root cert was added through Windows Update a to XP few years ago, so there's a decent chance boxes in the wild have. SNI is still a no-go on XP though.

handsomeransoms 13y ago

Webfaction enabled SNI on all of their servers in December 2011 [1], which means you no longer need to buy a dedicated IP address to use SSL. In fact, when they made this switch, they switched my server over to SNI automatically and stopped charging me the extra $5/month automatically. Awesome! A small fraction of Internet users on extremely out-of-date system cannot use SNI. If you need to support those users, you will still have to buy a dedicated IP address. I personally don't bother (if you're running IE 6 on Windows XP, you have bigger problems). This is a great guide! I did the exact same thing several months ago and am very happy with the result. Enough with the excuses not to deploy SSL! [1] https://blog.webfaction.com/2011/12/server-name-indication-enabled-on-all-servers/ https://blog.webfaction.com/2011/12/server-name-indication-e...

dangrossman 13y ago
Almost 1 in 5 people on the web are still running Windows XP. No version of Internet Explorer on XP supports SNI. Neither does Safari on XP, the browser in Android 2.x, the BlackBerry browser or Opera Mobile before 10.1. It may be a minority of users, but it's not just "people who are still running IE6". Pretty much everyone would love to use SNI; site owners wouldn't have to pay for extra IPs, hosting companies wouldn't have to worry about securing and allocating them just for SSL use, tons of IPv4 space could be put back into circulation, and CAs would be able to sell many more certs. Unfortunately the group that can't use it is too large to ignore, so none of that's happening.
- handsomeransoms 13y ago
  I appreciate your detailed response! I should not have been so dismissive of those users. Still, I maintain that the "extra cost for a dedicated IP" is a poor excuse for not implementing SSL.
  - agwa 13y ago
    Unfortunately. it's not always just the cost - too many providers (e.g. DigitalOcean) obnoxiously don't support multiple IP addresses on a server/VM.
    - jbrechtel 13y ago
      Why's this a problem related to SSL?
      - chrismorgan 13y ago
        Without SNI, SSL works on an IP address level rather than a hostname level, just like HTTP/1.0 worked at the IP address level and HTTP/1.1 works at the hostname level with the Host header. Read https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication for more info.