3 ms·
It looks like browsers basically all support SNI now, but unfortunately it also looks like that if you require SNI, you'll be giving up traffic from a fair numb
by agwa 12y ago
It looks like browsers basically all support SNI now, but unfortunately it also looks like that if you require SNI, you'll be giving up traffic from a fair number of RSS readers and search engine spiders, which makes this a non-starter for me. I'm surprised the author is OK giving up those 263 NewsBlur subscribers. I hope these RSS readers and spiders get fixed soon.
I don't think there's a point trying to send back an error document to clients that don't support SNI, since the client will get a certificate error before seeing any error that you send it. On the other hand, the clients that don't support SNI also look like just the type of clients that don't properly check certificates. If that's true, you're better off winging it without SSLStrictSNIVHostCheck and hoping that these old clients will ignore the certificate error and then be routed to the correct vhost anyways via the Host: header.
- eli 12y agoAll people using browsers on a modern OS support it. I've still got about 9% of traffic on Windows XP.
- icebraining 12y agoUsing Chrome or Firefox on Windows XP also works. It's only Internet Explorer that's screwed up.
- eli 12y agoGood point! That looks like it cuts it in half -- 4 or 5%.
- voidlogic 12y agoWhat about a modern browser on XP?
- mmastrac 12y agoAs long as it doesn't use the built-in Windows HTTPS stack (wininet/schannel), it's fine -- modern Chrome and FF will work just fine in this regard.
- Lukasa 12y agoBug report opened on NewsBlur: https://github.com/samuelclay/NewsBlur/issues/534 https://github.com/samuelclay/NewsBlur/issues/534 Because they're using Requests this should be a fairly trivial fix for them.