Hacker News Reader

Comment by kijin | Hacker News Reader

I recently bought a PositiveSSL certificate for less than $3 per year at gogetssl.com. That's less than one third of what I paid for the domain to use it on. If you can afford a domain, you can afford to put a SSL certificate on it.

Low-cost SSL brands like PositiveSSL and RapidSSL are so cheap nowadays, some registrars hand them out for free if you buy a domain. And they're compatible with every version of IE on Windows XP, unlike those free certs from StartSSL.

View on HN

The cost usually isn't so much the cost of the cert, it's more the cost of the static IP.

What browser would support HTTP 2.0 but not SNI?

I'd not heard of SNI before. Is this something that can be used now?!

Yes ... as long as you don't need to support IE on XP, Android 2.x, or Java 6.

https://en.wikipedia.org/wiki/Server_Name_Indication

> IE on XP, Android 2.x

That's still a lot of devices.

Neither of those browsers supports HTTP/2.0, so that's moot.

> IE on XP

In this case, that's also going away hard next year when Microsoft discontinues support for Windows XP. At that point it'd be really tempting to suggest switching to Firefox or Chrome, both of which do support SNI.

Lots of utilities that aren't conventional "browsers" but talk HTTP.

The question is still completely valid. What tool would support HTTP 2 but not SNI?

SNI is useful for hosting, but I don't think it helps embedded devices. Is any CA willing to issue me a cert for 192.168.0.1? Wait, don't answer that.

You can solve this by setting up your own Certificate Authority.

It'd be more interesting to see if a CA would issue a cert for something.local — sadly, you're probably right to fear the worst…

They will -- but I believe that's to be phased out by 2015 or so.

Why do you want to use global CAs for internal services? Wouldn't it be better to use your own CA? I find out that identifying site by it's certfingerprint is much stronger authentication than the fact that it got valid cert. Actually it would be a good idea not to trust any other than company's internal CA for internal services. But as far as I know, bowsers aren't up to this challenge. Maybe AD allows this, but I haven't ever seen any post how to do it.

If we'd get to it and get IPv6 up, the business of selling static IPs should become a very unprofitable as there would be a virtually unlimited supply of IPs. Why is this not happening?!?

For the same reason that SSL adoption is currently lower than ideal, for many uses the increased cost (actual cost, and cost of time) is not perceived to be worth it. For many/most uses IPv4 works just fine and non-SSL is just fine.

IPv6 is free as in 4 billion ^ 4 addresses free.

Presuming you're noting exponentiation with ^, 4 billion ^ 4 billion addresses would mean 128 gigabits per address. IPv6 addresses don't take up half a gigabyte each in any sane encoding.

IPv6 has 128-bit addresses, which works out to about 4 billion ^ 4 addresses, not 4 billion ^ 4 billion addresses.

My original comment said 4 billion ^ 4 addresses, as in 2^128. There is no second "billion" in that line.

Don't forget the cost and barrier to entry of setting up the cert and SSL and learning to administer the extra steps well, without introducing more holes through complexity.

What about embedded devices.

Not everything on the web is sitting on a well-known server.

Right - embedded devices, one off toy apps, a lot of internal organization pages, and a lot of hobbiest projects make up a huge part of the "web space". These will all suffer for more reasons than cost of certs - it adds a new hurdle and a barrier for entry.

Think about printers for a moment: now all the printers providing http interfaces need to include a way to install an organizational cert on them (at least for a lot of organizations). That means that there needs to be an out of band step in setup (and maintenance) to add the cert, or a way to do so from an http interface. The later just screams "giant security risk" for a dozen reasons.

I am sure it happens but you should not be exposing your printer to the Internet. That is just asking for trouble. You would not need HTTPS on an internal network.

But HTTP 2 requires it, no matter if you need it or not.

No, it doesn't. From the article: “To be clear - we will still define how to use HTTP/2.0 with http:// URIs, because in some use cases, an implementer may make an informed choice to use the protocol without encryption.”

The reason for your parent comment (and my initial misunderstanding) was because this post title was submitted as "HTTP 2.0 to be HTTPS only". By the time I refreshed the title was changed, but this is why we need to stop modifying original article titles in order to bait more views.

So you require a cert for personal projects. That doesn't mean a cert that chains to a public trust. You could easily cut your own cert and trust it on whatever device you wish to access the site on

And for e.g. intranet usage the organisation could set up their own internal CA to validate TLS certificates. The root certificate could be distributed in a manner suitable to the organisation. E.g. via Group Policy for Windows clients, or by simply including it in the disk image used for setting up new machines.

> You would not need HTTPS on an internal network.

This is false. Good security is layered security.

> You would not need HTTPS on an internal network.

Oh, really?

http://www.washingtonpost.com/world/national-security/nsa-in...

Sure, but there are many new (and not-so-new) "internet of things" devices that explicitly _do_ want to be able to connect to the internet - and a great deal of additional value derives from that ability.

I've spent a lot of time recently working out how to securely allow a set of christmas tree lights with an embedded linux controller[1] with wifi connect via OAuth to your Twitter or Facebook account while being controlled from your phone. The lack of workable/affordable ways to have SSL keys on the device that your phone will trust makes life _very_ interesting - and getting the password-equivalent OAuth tokens into the device has been a fun challenge.

[1] Gratuitous self promotion - http://moorescloud.com/ go pre-order one now to justify getting UL certification so we can sell 'em in North America! _Please!_ ;-)

sounds like devices that wouldnt make the switch to http 2 anyway

So your argument is lets create a new version of a protocol, but make it less capable than the version which proceeds it, so that there are very valid use-cases which cannot be solved using the new protocol-version, forcing us to rely on multiple protocol-versions for what should be the same thing?

How on earth do you make such an argument make sense?

Did you mean to send that reply to me?

And what about wildcard certificates?

The good ol' Subdomain-versus-Subfolder debate just gets a bit more expensive on the left side, that's all.

Services that really need an unlimited number of subdomains are a tiny minority, and market prices reflect this. For the time being, someone like WordPress.com can probably afford $60-$100/year for a wildcard certificate. Everyone else just sticks to subfolders like Twitter does.

After all, nobody will be preventing you from running a website. Your priorities and economic circumstances might prevent you from using pretty subdomains, but that's no different from the current reality where short and memorable dot-com domains cost thousands of dollars.

And they're compatible with every version of IE on Windows XP, unlike those free certs from StartSSL.

This matter has nothing to do with the version of IE and everything to do with whether Windows root cert update is turned on.

Domain names at that price should include an SSL certificate.

Reply on news.ycombinator.com