Hacker News Reader

Hacker News

Comment by pixelcort | Hacker News Reader

Parent Full thread

pixelcort

The cost usually isn't so much the cost of the cert, it's more the cost of the static IP.

View on HN

What browser would support HTTP 2.0 but not SNI?

I'd not heard of SNI before. Is this something that can be used now?!

Yes ... as long as you don't need to support IE on XP, Android 2.x, or Java 6.

https://en.wikipedia.org/wiki/Server_Name_Indication

> IE on XP, Android 2.x

That's still a lot of devices.

Neither of those browsers supports HTTP/2.0, so that's moot.

> IE on XP

In this case, that's also going away hard next year when Microsoft discontinues support for Windows XP. At that point it'd be really tempting to suggest switching to Firefox or Chrome, both of which do support SNI.

Lots of utilities that aren't conventional "browsers" but talk HTTP.

The question is still completely valid. What tool would support HTTP 2 but not SNI?

SNI is useful for hosting, but I don't think it helps embedded devices. Is any CA willing to issue me a cert for 192.168.0.1? Wait, don't answer that.

You can solve this by setting up your own Certificate Authority.

It'd be more interesting to see if a CA would issue a cert for something.local — sadly, you're probably right to fear the worst…

They will -- but I believe that's to be phased out by 2015 or so.

Why do you want to use global CAs for internal services? Wouldn't it be better to use your own CA? I find out that identifying site by it's certfingerprint is much stronger authentication than the fact that it got valid cert. Actually it would be a good idea not to trust any other than company's internal CA for internal services. But as far as I know, bowsers aren't up to this challenge. Maybe AD allows this, but I haven't ever seen any post how to do it.

If we'd get to it and get IPv6 up, the business of selling static IPs should become a very unprofitable as there would be a virtually unlimited supply of IPs. Why is this not happening?!?

For the same reason that SSL adoption is currently lower than ideal, for many uses the increased cost (actual cost, and cost of time) is not perceived to be worth it. For many/most uses IPv4 works just fine and non-SSL is just fine.

Don't forget the cost and barrier to entry of setting up the cert and SSL and learning to administer the extra steps well, without introducing more holes through complexity.

IPv6 is free as in 4 billion ^ 4 addresses free.

Presuming you're noting exponentiation with ^, 4 billion ^ 4 billion addresses would mean 128 gigabits per address. IPv6 addresses don't take up half a gigabyte each in any sane encoding.

IPv6 has 128-bit addresses, which works out to about 4 billion ^ 4 addresses, not 4 billion ^ 4 billion addresses.

My original comment said 4 billion ^ 4 addresses, as in 2^128. There is no second "billion" in that line.

Reply on news.ycombinator.com