4 ms·

An obvious move for Amazon. They'll be able to make SSL certificate management pretty painless for people using ELB.

• eli 11y ago
  I wonder if they have plans for CloudFront too. That'd be a killer feature to be able to use HTTPS on cloudfront on a custom domain without it costing a fortune.
  • x5n1 11y ago
    > costing a fortune. The problem is not the SSL certificate, the problem is the IP address. That will no longer be a problem as soon as IPv6 takes hold in a few years, I give it about 3. They currently have to deploy the SSL certificate to over 30 different IPs hence it costing the immense amount. The certificate can be had for $10.
    • toomuchtodo 11y ago
      Why would anyone use non-SNI SSL/TLS anymore? Are there really that many Windows XP clients out there?
      • eropple 11y ago
        One of my clients still sees a surprising amount of Android 2.x traffic. Other than that, yeah, I can't see a reason.
      • mike-cardwell 11y ago
        Exactly. I default to SNI being acceptable now, unless somebody has convincing evidence that for their particular use case they can't use it.
      • eli 11y ago
        I dunno where the line it, but Windows XP is in the ballpark of 2% of our traffic, depending on the site and how you measure it. The bummer is that HTTPS breaks kinda badly if you use an SNI cert and the OS/browser doesn't support it.
        • Dylan16807 11y ago
          2% is IE on XP, or XP in general? I wish people would be more clear when they bring up XP. The OS is not the problem.
          • ademarre 11y ago
            > 2% is IE on XP, or XP in general? The latter sounds more likely to me. The sites I run get about 2.5% XP, but most of that population uses Chrome or Firefox. IE on XP accounts for only 0.3% overall.
          • rodgerd 11y ago
            At this point my experience is that most people still on XP are using IE - it mostly appears to be institutions that are still(!) using a primitive corporate build.
      • stenius 11y ago
        python 2.7 doesn't support SNI which is used by a lot of consumers of APIs
        • hnmsc12 11y ago
          Python 2.7.9 supports SNI: https://www.python.org/downloads/release/python-279/ https://www.python.org/downloads/release/python-279/
  • servercobra 11y ago
    You already can do that for pretty cheap (if you use SNI), but only from the CLI and the command isn't exactly simple. [0] Having it integrated so you just click 'yes, SSL' and it handles cert generation and config would be great. [0] https://bryce.fisher-fleig.org/blog/setting-up-ssl-on-aws-cloudfront-and-s3/ https://bryce.fisher-fleig.org/blog/setting-up-ssl-on-aws-cl...
    • eli 11y ago
      Neat! I had missed the rollout of SNI certs.
  • psychometry 11y ago
    What's the benefit to serving your assets from a custom SSL-secured domain over https://whatever.cloudfront.net https://whatever.cloudfront.net? The end-user doesn't really care what domain they're served from.
    • blowski 11y ago
      Use case: If you want to serve an entire site (i.e. the HTML as well as the assets) from CloudFront over https.
    • ceejayoz 11y ago
      You can sit CloudFront in front of the entire site (not just assets, similar to CloudFlare) and tell it to proxy POST requests to the origin.
• oasisbob 11y ago
  More than that, the Mozilla request also mentions code signing certs, makes it clear this is not just an internal AWS thing: Customers of the Amazon PKI are the general public. We do not require customers that customers have a domain registration with Amazon, use domain suffixes where Amazon is the registrant, or have other services from Amazon.
• makeitsuckless 11y ago
  That would be nice, since managing SSL certs on ELB is currently the most painful way I've ever experienced. The documentation is vague, it's extremely finicky and doesn't give any useful feedback if you've done anything "wrong".