3 ms·

Given that almost all clients support SNI (https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication) nowadays,

by gst 12y ago

Given that almost all clients support SNI (https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication) nowadays, there's not really a need anymore for wildcard certificates (if all you want to do is enable a few subdomains).

brunoqc 12y ago
With SNI do you still need one certificate for each subdomain?
- andrewmunsell 12y ago
  Yes. SNI just allows you to have multiple SSL certificates per server IP address.
  - brunoqc 12y ago
    I have multiples vhosts per IP with nginx and SSL. Does it use SNI and does that mean that some older browsers could have problems accessing it?
    - gst 12y ago
      Yes to both questions (under the assumption that those vhosts use different SSL certificates).
      - brunoqc 12y ago
        Thanks!
marcosdumay 12y ago
Unfortunately, Android 2.3 phones are still sold on big quantities, and don't support SNI. Maybe you can just ignore them, or maybe you can't. Anyway, it's not a no-brainer.
- freehunter 12y ago
  Working at a previous employer a few months ago, their McAfee Web Gateway didn't support SNI either. Sites that depended on it were blocked due to a server name mismatch.