Comment by _delirium | Hacker News Reader

Comment by _delirium | Hacker News Reader

Parent Full thread

For big sites, sure. But at least as things currently stand, that's infrastructure-inconvenient and somewhat pricey on the low end, especially if you operate multiple sites and they come and go as hobby projects. Not because of the compute overhead (negligible for my uses), but because of the need for a (non-self-signed) SSL certificate, plus a unique IPv4 address, for each domain. Digital Ocean, for example, won't give you more than 1 IPv4 address per VPS, which means you need a separate VPS for every side project, if you want to go HTTPS. I prefer to multiplex all my tiny projects on one VPS, saving both the extra $60/yr per project and the extra sysadmin overhead. Plus $50/yr for the certificate, and $15 for the domain, and you have a startup cost of $125/yr per side project... versus $15/yr that it currently costs me. Not huge, but more than I want to pay, and raises the mental friction on something that I currently consider near-free/throw-away.

If IPv6 actually gets deployed to the extent that I can have an IPv6-only site without needing IPv4 addresses, and someone solves the SSL signing mess, I'd be happy to use it.

As others mentioned, you can run multiple sites using SNI. You can also get a free cert from StartSSL. The barrier to entry is really low.

The only scenario where I wouldn't do it is a blog. There's probably no sensitive content there and without SSL you can use the free trier at CloudFlare to HN-proof it.

Unfortunately, SNI support is still slightly limited, though admittedly it's a fantastic solution for the majority of the usage cases. :)

StartSSL has free certificates, or you can pay $60 for validation for a year which gives you unlimited certificates on unlimited domains with a 2Y expiry, so if your set of domains is reasonably static you only have to pay every two years.

You can also get alt names on your certificates, so if you want to support IE on XP or Android 2.2 then you can put several domains on the same certificate.

I have no interest in StartSSL, just a happy customer :).

> Digital Ocean, for example, won't give you more than 1 IPv4 address per VPS, which means you need a separate VPS for every side project, if you want to go HTTPS.

As long as you're not supporting clients running IE on WinXP or other similarly old web browsers, Server Name Indication (where the hostname is included as a part of the handshake) will work and it'll eliminate your need for more than one IP.

I just typed a similar comment at nearly the same time but this is interesting to learn. I had no idea XP didn't like this? I know Android 2.2 and older wouldn't take intermediate SSL certs so I've already written off some of my traffic. Now I'll add XP to the group. In fairness, running XP or Android 2.2 now and you have bigger problems than SSL not working...

Setting up SSL even for small sites can be a HUGE PITA. Adding a Custom Cert to CloudFlare will cost you 200 a month[1].

It shouldn't be hard and you should have to pay such a premium for something that should just work by default. I helped create a Front-end PaaS a little while back[2] that believed in that philosophy, we worked hard to lower the barrier of entry for most things, including SSL.

The reality is understanding SSL, Encryption and everything involved is still overwhelming for most people. This article helps but we need more services to stop gouging people for doing or trying to do the right thing.

[1] https://www.cloudflare.com/plans [2] https://blog.harp.io/posts/harp-platform-now-public

You don't need a unique IP per domain for SSL. I've got multiple $10/yr certs via Gandi for domains and I can put several on one DO VPS if I like. Tested and working, I have had no trouble at least with a basic SSL cert.

> Plus $50/yr for the certificate

This is certainly no longer true. $7 for a cert from Namecheap (domain validated).

Interesting, I guess I need to change providers. I last used RapidSSL, which advertises itself as a "low-cost" provider at $49: https://www.rapidssl.com/buy-ssl/

Interestingly you can buy the same RapidSSL certificate through Namecheap for $9.49. I'm not sure why they allow resellers to undercut them so dramatically, but I have been using Namecheap's version for years and the savings add up.

https://www.namecheap.com/ssl-certificates/geotrust-ssl-cert...

Just had a look at namecheap, can anyone explain the main reason to forgo the PositiveSSL option ($7/annum) and take out their more expensive option; EssentialSSL ($21/annum).

You get a "site seal" with EssentialSSL. Both are equivalent on a technical level, so go with PositiveSSL unless your users care about SSL branding (most don't).

While your other points are all valid, certificates can be bought on the cheap, at least for side projects: $8/y from Comodo, $9.5/y from GeoTrust.

Reply on news.ycombinator.com