12 ms·
Cost is one factor, but SNI also has performance and IPv4 exhaustion repercussions as well. An SSL cert chain with 30 SANs is 4.3kb, versus 2 SANs at 2.5kb. Th
by skuhn 11y ago
Cost is one factor, but SNI also has performance and IPv4 exhaustion repercussions as well.
An SSL cert chain with 30 SANs is 4.3kb, versus 2 SANs at 2.5kb. This is data that is sent for every new connection, and nothing can happen until it is successfully received and processed by the client. This isn't a huge overhead, particularly with modern initcwnd settings, but there is a benefit to a smaller SSL handshake payload.
The other part is IPv4 exhaustion. Think of how many IP addresses are currently in use solely for the purpose of SSL virtual hosting. This is why CDNs charge such exorbitant fees for SSL certs, because they a) want to discourage you from doing it and b) have to incur real expenses to maintain their dwindling supply of v4 space.
We're past the point where it's alright to not support SNI. It isn't the server's fault anymore if you can't connect, it is your client's fault now.