Hacker News Reader

Comment by jes5199 | Hacker News Reader

an annoying thing about HTTPS is that it requires you to serve each domain name from a separate IP address, and that can be somewhat costly.

View on HN

No it doesn't. You can use multi-domain certificates. Works like a charm.

Also, I talked to GlobalSign recently, and they had a brand new solution that used SNI with an automatic fallback to multi-domain certificate for browsers that don't support SNI.

multi-domain certs are brittle, because you have to keep them up to date with all the domains you're serving.

That doesn't make them brittle, it does make updating them a potential single point of failure. But that goes for multiple things if you're working from one single IP address, so accounting for those is part of the tradeoff.

If you ignore IE+Windows XP, you can safely use SNI.

I would love to...Who's with me? Anyone? Anyone? Bueller?

Alas, while I feel comfortable not XB testing WinXP because it's less than 1% of users (or whatever threshold you want), I'm not quite as comfortable using that argument with SSL certs. Unfortunately the two solutions (SNI and IPv6) are unlikely to work on XP, so the only hope is to wait until all those computers are replaced or upgraded.

... and the stock Android browser, IIRC.

Fixed since 3.x: https://code.google.com/p/android/issues/detail?id=12908#c13

True, but just like XP, there are lots of pre-3.x devices out there...

That would be approximately 50% of them, btw.

It's any browser on XP which uses the Windows Crypto API, most notably probably the second most used browser, Chrome. As long as XP is around, we're going to need One IP address per domain if we want to do SSL.

Chrome 6+ appears to support SNI on XP

[1] https://code.google.com/p/chromium/issues/detail?id=43142

[2] http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers...

This is why widespread IPv6 can't come soon enough. You can give whole subnets to each subdomain if you feel like it, without paying a cent...

SNI has been out for a long time. Windows XP with IE < 8 doesnt support it, but at this point, Microsoft has practically abandoned it so it seems reasonable to let those users suffer and tell them to use Firefox/Chrome.

>Windows XP with IE <= 8

FTFY.

What does the message they see say? Presumably invalid cert before you get to being able to say anything. Its OK if you just have part of site HTTPS but difficult if it all is?

Reply on news.ycombinator.com