Hacker News Reader

Comment by symkat | Hacker News Reader

Also keep in mind that SSL makes serving sites based on the host header much more difficult, and is one of a handful of justifications for additional IPs according to ARIN. Last I checked running multiple sites from a single IP with one of them using SSL was against something, but I can't seem to find that now.

Although it is trivial to implement SSL, you should only do it if you need to because of the above, using up all the IPv4 addresses because your random video sharing website might have a user somewhere on a wireless network where their cookies are hijacked. This attack has existed for pretty much ever and isn't very useful for a dedicated focused attack.

View on HN

There are three options that I know of:

1) SNI -- this has just too poor support at this time

2) Separate ports -- you can make make Apache listen on for example port 446 and use links like https://subdomain.foobar.com:446/.... -- however some corporate firewalls etc. may be blocking connections out on non-standard ports; we just that just for multiple testing environments. This still requires multiple certs or a wildcard cert.

3) Wildcard certs -- they are are usually quite bit more expensive but they'll let you register *.domain.com. So if a client wants a subdomain you can let them have client.yourdomain.com that way without multiple certs or IPs -- FogBugz uses that for example.

There's something called Server Name Indication that allows name-based virtual hosting with https. There's some good information here about it: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

The problem is browser support isn't quite where it needs to be, with IE only supporting it in 7.0+ on Vista or later (IE 6 or IE anything running on Windows XP is out of luck).

I was testing an app with SNI SSL today and can confirm Firefox on Windows 7 throws an error.

It is not generally possible to serve more than one https domain from a server, because browsers won't accept more than one certificate.

However just because you serve one site doesn't mean that you use one IP more, nor do you contribute to the exhausting of ipv4 addresses -- you already use your ip to connect to your server.

It's also possible to run multiple SSL sites on one IPv4 address by assigning them to ports other than 443. It won't look pretty, but not too much hassle if you absolutely want to protect your logins.

Reply on news.ycombinator.com