4 ms·

Seriously, SSLs basically 2x the hosting cost for low end hosting packages. Not great for people running small websites.

adventured 12y ago
SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too: $9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden. https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx https://www.namecheap.com/security/ssl-certificates/domain-v...
- nosefrog 12y ago
  I understand what you're saying, requiring SSL doesn't seem like too much of a burden superficially. But it's magnitudes harder and more frustration inducing than simply buying a domain. My website is protected by the cheapest certificate on that list, and it was a gigantic pain to set up. Also, only the root subdomain on my site is protected -- I have things on other subdomains which I can't encrypt because $10 dollars a year quickly adds up.
- joelrunyon 12y ago
  but you have to get a dedicated IP as well, which means you can host less sites on a small server - something bad for smaller biz.
  - nirvdrum 12y ago
    All modern browsers support SNI [1]. I guess if you need to support IE8 on WinXP you'll have problems. And IIRC, wget on Ubuntu 12.04 doesn't support it (while curl does). But it's picked up a lot in recent years, which thankfully eases the dedicated IP requirement in many cases. [1] -- http://en.wikipedia.org/wiki/Server_Name_Indication http://en.wikipedia.org/wiki/Server_Name_Indication
  - singlow 12y ago
    Absolutely no need for a dedicated IP unless you want to support very old versions of Windows or very old versions of Android. I haven't allocated a dedicated IP solely for SSL in years.
- whyenot 12y ago
  "hosting package" =/= "cert[ificate]"
- gabemart 12y ago
  >$9 - $11 / year for perfectly good certs So long as you don't need any subdomains, right?
- xorcist 12y ago
  That's not the cost. You have to pay someone to re-sign your cert every (other) year. This is a largely manual process. It's also going to cost you, if you want any compensation at all when they forget. Which they will, no matter how well you prepare.
pdkl95 12y ago
That is today's prices, based past demand. As demand for SSL hosting goes up, gradually replacing plaintext hosting, the price will come down. I actually expect the price of plaintext HTTP hosting to go up a bit; partly due to reduced demand, but also due to increased risk/liability. With SSL being the "industry best practice", I expect at least a few bean counters will view the risk of private information leaks or hypothetical legal liability for enabling DDOS (similar to the "attractive nuisance" doctrine). There will be a turbulent transition period, of course. As someone currently living at the poverty line, I have argued against the CA system many times. A SSL cert (and anual renewal) may be an insignificant cost to some people, but it is a real barrier when tha cost represents days/weeks of food. Unfortunately, none of this removes the need for encryption or the risks of plaintext. This is why I'm very excited about Let’s Encrypt; It might solve the cost problem, and it might avoid the StartSSL "no second-source" problem because it is a protocol first. Internet use is only going up, so these transition costs are only going to go up. We can pay it now, or pay even more in the future.
- merrua 12y ago
  Demand going up does not always mean that pricing goes down. Especially when supply is limited
  - pdkl95 12y ago
    Obviously. What's your point? That the price of SSL hosting will stay the same? Go up? I never claimed it would equalize perfectly, just that it would get cheaper in the future. Also, why do you think the supply of SSL hosting services is necessarily limited any more than traditional plaintext hosting would be?

adventured 12y ago

SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too: $9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden. https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx https://www.namecheap.com/security/ssl-certificates/domain-v...

nosefrog 12y ago
I understand what you're saying, requiring SSL doesn't seem like too much of a burden superficially. But it's magnitudes harder and more frustration inducing than simply buying a domain. My website is protected by the cheapest certificate on that list, and it was a gigantic pain to set up. Also, only the root subdomain on my site is protected -- I have things on other subdomains which I can't encrypt because $10 dollars a year quickly adds up.
joelrunyon 12y ago
but you have to get a dedicated IP as well, which means you can host less sites on a small server - something bad for smaller biz.
- nirvdrum 12y ago
  All modern browsers support SNI [1]. I guess if you need to support IE8 on WinXP you'll have problems. And IIRC, wget on Ubuntu 12.04 doesn't support it (while curl does). But it's picked up a lot in recent years, which thankfully eases the dedicated IP requirement in many cases. [1] -- http://en.wikipedia.org/wiki/Server_Name_Indication http://en.wikipedia.org/wiki/Server_Name_Indication
- singlow 12y ago
  Absolutely no need for a dedicated IP unless you want to support very old versions of Windows or very old versions of Android. I haven't allocated a dedicated IP solely for SSL in years.
whyenot 12y ago
"hosting package" =/= "cert[ificate]"
gabemart 12y ago
>$9 - $11 / year for perfectly good certs So long as you don't need any subdomains, right?
xorcist 12y ago
That's not the cost. You have to pay someone to re-sign your cert every (other) year. This is a largely manual process. It's also going to cost you, if you want any compensation at all when they forget. Which they will, no matter how well you prepare.

pdkl95 12y ago

That is today's prices, based past demand. As demand for SSL hosting goes up, gradually replacing plaintext hosting, the price will come down. I actually expect the price of plaintext HTTP hosting to go up a bit; partly due to reduced demand, but also due to increased risk/liability. With SSL being the "industry best practice", I expect at least a few bean counters will view the risk of private information leaks or hypothetical legal liability for enabling DDOS (similar to the "attractive nuisance" doctrine). There will be a turbulent transition period, of course. As someone currently living at the poverty line, I have argued against the CA system many times. A SSL cert (and anual renewal) may be an insignificant cost to some people, but it is a real barrier when tha cost represents days/weeks of food. Unfortunately, none of this removes the need for encryption or the risks of plaintext. This is why I'm very excited about Let’s Encrypt; It might solve the cost problem, and it might avoid the StartSSL "no second-source" problem because it is a protocol first. Internet use is only going up, so these transition costs are only going to go up. We can pay it now, or pay even more in the future.

merrua 12y ago
Demand going up does not always mean that pricing goes down. Especially when supply is limited
- pdkl95 12y ago
  Obviously. What's your point? That the price of SSL hosting will stay the same? Go up? I never claimed it would equalize perfectly, just that it would get cheaper in the future. Also, why do you think the supply of SSL hosting services is necessarily limited any more than traditional plaintext hosting would be?