3 ms·
If this is a very long-term plan, I'm all up for it. In the short term, we're just not quite where we need to be in order to enable SSL even on less-important s
by pilif 12y ago
If this is a very long-term plan, I'm all up for it. In the short term, we're just not quite where we need to be in order to enable SSL even on less-important sites or sites that don't require any credentials.
From a hardware perspective, I'd say that by now the problem is actually solved. Hardware is powerful enough to handle SSL connections.
What's currently tricky is that too big a chunk of clients still doesn't support SNI which really doesn't go well with the increasing scarceness of IP addresses.
Needing one IP address per unique domain name, aside of the administrative overhead (multi-homing still is somewhat inconvenient) will just not be feasible as the costs for IP addresses is starting to skyrocket.
This will be fixed by either IPv6 growth (you wish) or the death of non-SNI systems, but it'll be years if not decades before we can ignore XP and Android 2.3, especially as there's no good fallback path for these clients as the SSL negotiation (and subsequent hostname validation failure) happens way before the host could react.
- kijin 12y ago> Needing one IP address per unique domain name I'm tired of this bullshit. This has never been true, not even 10 years ago. You only need one IP:port combination per unique domain name. You can host tens of thousands of HTTPS websites on a single IP even if none of your users support SNI, and you don't have to pay for a SAN certificate, either. You can serve HTTPS on port 31276 as long as you redirect properly from plain HTTP. You could even redirect conditionally, i.e. modern browsers and search engines are redirected to port 443 while the remainder are told to try port 31276. Is this ugly? Yes. Do people care? No. A client of mine who uses shared hosting is perfectly happy with HTTPS on port 44527. Most people don't even look at the URL. Who knows, they might even think that the secret number makes their website more secure. (Of course it doesn't, but their misconception doesn't make their website any less secure, so I don't care.) Older browsers not supporting secure ciphers/protocols is a bigger problem, but you can also get around this to some extent by offering better ciphers/protocols on port 443 and lesser ciphers/protocols on an alternate port.
- pilif 12y agoYeah. Sure. Non-standard ports will work really well in combination with enterprise firewalls. I would furthermore wager a guess that the intersection between XP users and users behind firewalls is quite big, actually.
- kijin 12y agoYeah. Sure. If your service absolutely needs to be accessible to "enterprise" users, you can probabaly afford a dedicated IPv4 address.
- davidjgraph 12y ago"too big a chunk of clients still doesn't support SNI" I'm not sure that's true today, what's your list? XP is only a problem when using IE. Android 2.2 and 2.3 are well under 10% last numbers I saw. They are very close to where we can make a greater good argument.
- pilif 12y agoWindows XP, Android 2.3 and many scripts running on various old but still supported Linux Distros (RHEL 6 for example) and, of course, the Bing Bot.