3 ms·
For HTTPS you need a dedicated IP since security negotiation happens before the HTTP hosts header is posted and your cert needs to cover the host you want to co
by trezor 17y ago
For HTTPS you need a dedicated IP since security negotiation happens before the HTTP hosts header is posted and your cert needs to cover the host you want to connect to. That is, it is impossible to host several sites using HTTPS on one single IP. HTTPS using SSL (instead of for instance TLS) means that this is a limitation built into HTTPS itself and can't be mitigated.
With the current shortage on IPv4 IPs and most shared hosters trying to squeeze as many websites as possible onto the same single IP, that effectively means that getting a site up and running with HTTPS (and that is not even mentioning the cost of getting a properly signed certificate) is very, very costly and hard compared to regular HTTP hosting.
Until IPv6 goes mainstream don't expect any of this to change.
- agl 17y agoSNI (Server name indication)[1] is designed to fix this. It's a TLS extension which lets the server know the hostname that the client is expecting. It can then reply with the correct certificate. However, I note from the Wikipedia page that XP doesn't support this (!). I had thought this a solved problem :( [1] http://en.wikipedia.org/wiki/Server_Name_Indication http://en.wikipedia.org/wiki/Server_Name_Indication
- donw 17y agoIf you're like most newer startups that have their customers under a TLD (foo.mycorp.com, bar.mycorp.com), you can use wildcard SSL to manage the problem. Otherwise, yeah, you're looking at one IP per TLD.
- kdw 17y agoAm I correct in thinking that a wildcard only gets you one level deep? e.g. that *.mycorp.com matches "foo.mycorp.com" but not "foo.bar.mycorp.com"?
- bensummers 17y agoDepends on the browser, which in practice means just one level deep.
- revicon 17y agoReading everyone's reasons for not implementing SSL, I'm wondering, how do you handle user logins? I'm building a site right now, and I need to create user accounts, and allow them to login with a username/password. Seems irresponsible to have them pass their password as cleartext when they log in. What do you do instead?