3 ms·
> Is there a GOOD reason why we aren't defaulting to these modes nowadays? Two of them: (1) SSL certificates for public-facing sites (where you don't control
by dangrossman 13y ago
> Is there a GOOD reason why we aren't defaulting to these modes nowadays?
Two of them:
(1) SSL certificates for public-facing sites (where you don't control the trusted CAs/certs) cost money. More money than many individuals with sites spend on their hosting.
(2) Because you need one IP address per domain to do SSL, which costs even more money. Most sites are on shared hosting where dedicated IPs are not even offered, and on VPS/dedicated hosting additional IPs cost extra.
There's not enough free IPv4 space available to switch every domain to SSL if we wanted to. It won't be until Windows XP and Android 2.x usage is much lower that we can start using SNI on public-facing websites, which would relieve us of the need for a separate IP per domain.
On a personal note, SSL can be really expensive even if you're willing to spend money on it. I run three sites that give users subdomains. To run SSL on the sites, I need three wildcard certificates that cost over $300 per year.
- toomuchtodo 13y ago1) Free SSL certificates: http://www.startssl.com/ http://www.startssl.com/ 2) The benefits of SSL far outweigh the inability to serve XP and Android 2.X clients. Use a dedicated IP if you can and its cost-effective, if not, use SNI.
- dangrossman 13y ago1) Not free for commercial use per their terms of service. You have to use their $59.90+ paid product. 2) No, the benefits of SSL do not "far outweigh" the cost of not being available at all. If 1 in 5 people can't reach your site, it doesn't matter how secure you are. That's about how much of the web you would be shutting out by deploying SNI today. If those were reasonable choices to make, at least some companies would be making them, but not a single well-known site has done so.