6 ms·

FYI, these do not allow you to specify a wildcard, and SSL protect your subdomains.

by mkonecny 12y ago

korzun 12y ago
Why would a $5 certificate allow wildcards?
- evv 12y ago
  You're right that issued wildcard certs are typically quite expensive, starting around $100/yr. But a wildcard is not difficult for anyone to implement- it is literally just adding an asterisk to the host name in the cert. Nothing beats the profit margins of the SSL industry.
  - korzun 12y ago
    Heh, compared to prices back in the day (2000~) the current prices are extremely competitive. I remember breaking a piggy bank to secure a single domain back then, it was around $99+. Then dropped to $49.99 and now it's $9.99.
  - Artemis2 12y ago
    The SSL industry is so broken...
    - spacefight 12y ago
      Depends on which side you are ;) I agree though, it's totally broken, but not only the industry, the whole SSL system is broken.
      - syntaxgoonoo 12y ago
        Please explain?
- mkonecny 12y ago
  A few years ago you might also ask why would anyone give out $5 certificates? It's not any more work on their part - it's a extra parameter sent to their certificate generator.
  - spacefight 12y ago
    It's not even an extra parameter, it's just an the wildcard domain prefix .* within the DN to set. Wildcard SSL certs are THE rip-off...
    - adamtj 12y ago
      Rip-off? Bah! That's nothing compared to Microsoft's SQL Server! With SSL, you have to add the asterisk for more functionality. It takes a bit more work and they charge you 10x the price. With SQL Server, you can get the Express Edition for $0 or the Enterprise Edition for $thousands. But to build the Enterprise Edition, they actually compile it from the same source code without some #defines that enable various Express Edition data size limits. They do less work yet charge you infinity times the price. Now that's a ripoff!
gst 12y ago
Given that almost all clients support SNI (https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication) nowadays, there's not really a need anymore for wildcard certificates (if all you want to do is enable a few subdomains).
- brunoqc 12y ago
  With SNI do you still need one certificate for each subdomain?
  - andrewmunsell 12y ago
    Yes. SNI just allows you to have multiple SSL certificates per server IP address.
    - brunoqc 12y ago
      I have multiples vhosts per IP with nginx and SSL. Does it use SNI and does that mean that some older browsers could have problems accessing it?
      - gst 12y ago
        Yes to both questions (under the assumption that those vhosts use different SSL certificates).
        brunoqc 12y ago
        Thanks!
- marcosdumay 12y ago
  Unfortunately, Android 2.3 phones are still sold on big quantities, and don't support SNI. Maybe you can just ignore them, or maybe you can't. Anyway, it's not a no-brainer.
  - 12y ago

FYI, these do not allow you to specify a wildcard, and SSL protect your subdomains.

korzun 12y ago

Why would a $5 certificate allow wildcards?

evv 12y ago
You're right that issued wildcard certs are typically quite expensive, starting around $100/yr. But a wildcard is not difficult for anyone to implement- it is literally just adding an asterisk to the host name in the cert. Nothing beats the profit margins of the SSL industry.
- korzun 12y ago
  Heh, compared to prices back in the day (2000~) the current prices are extremely competitive. I remember breaking a piggy bank to secure a single domain back then, it was around $99+. Then dropped to $49.99 and now it's $9.99.
- Artemis2 12y ago
  The SSL industry is so broken...
  - spacefight 12y ago
    Depends on which side you are ;) I agree though, it's totally broken, but not only the industry, the whole SSL system is broken.
    - syntaxgoonoo 12y ago
      Please explain?
mkonecny 12y ago
A few years ago you might also ask why would anyone give out $5 certificates? It's not any more work on their part - it's a extra parameter sent to their certificate generator.
- spacefight 12y ago
  It's not even an extra parameter, it's just an the wildcard domain prefix .* within the DN to set. Wildcard SSL certs are THE rip-off...
  - adamtj 12y ago
    Rip-off? Bah! That's nothing compared to Microsoft's SQL Server! With SSL, you have to add the asterisk for more functionality. It takes a bit more work and they charge you 10x the price. With SQL Server, you can get the Express Edition for $0 or the Enterprise Edition for $thousands. But to build the Enterprise Edition, they actually compile it from the same source code without some #defines that enable various Express Edition data size limits. They do less work yet charge you infinity times the price. Now that's a ripoff!

gst 12y ago

Given that almost all clients support SNI (https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication) nowadays, there's not really a need anymore for wildcard certificates (if all you want to do is enable a few subdomains).

brunoqc 12y ago
With SNI do you still need one certificate for each subdomain?
- andrewmunsell 12y ago
  Yes. SNI just allows you to have multiple SSL certificates per server IP address.
  - brunoqc 12y ago
    I have multiples vhosts per IP with nginx and SSL. Does it use SNI and does that mean that some older browsers could have problems accessing it?
    - gst 12y ago
      Yes to both questions (under the assumption that those vhosts use different SSL certificates).
      - brunoqc 12y ago
        Thanks!
marcosdumay 12y ago
Unfortunately, Android 2.3 phones are still sold on big quantities, and don't support SNI. Maybe you can just ignore them, or maybe you can't. Anyway, it's not a no-brainer.
- 12y ago