Hacker News Reader

SSL/TLS is entirely a server/client exchange that has absolutely nothing to do with IP addresses. If you get the wrong certificate, you have either a crappy client, a crappy server, a misconfigured client, or a misconfigured server. For each case, there is a workaround, and that is where the inconvenience lies.

View on HN

Mostly true now, but not historically true - until SNI [1] was rolled out widely, implementing SSL absolutely required a dedicated IP. Short story shorter, the TLS handshake happens before the Host: header exchange in HTTP; before SNI there wasn't any way for a host that responded to multiple names to identify which cert to use for the handshake.

[1] SNI - http://en.wikipedia.org/wiki/Server_Name_Indication

That's still not quite true -- subject alternative names allow you to put multiple domains on a single certificate. That does raise trust issues if you're doing shared hosting, but it should be fine if you run all of the sites and don't mind them being obviously linked.

Reply on news.ycombinator.com