Hacker News Reader

They do offer free SSL with SNI. But that's not viable for most people given the number of popular older browsers missing SNI support.

Browsers that do support SNI include:

IE7+ (unless running on Windows XP)

Firefox 2.0 and later

Opera 8.0 and later

Chrome 6 and later (unless running on Windows XP)

Safari 3.0 and later

Android default browser on Android 3.0 and later (this is probably the biggest chunk of users)

Windows Phone 7

So, realistically, you're looking at people who still use Windows XP (unless they're using Firefox) and people with really old Android phones that'll never receive a manufacturer firmware update.

Could you add a global variable to your site code with the fqdn of your assets to point to the origin for times like this?

$600 per month for what exactly? (honestly asking here)

Without SNI, you need a dedicated IP per certificate. For CloudFront, this means dozens of dedicated IPs around the world just for your distribution.

Ah, makes sense! Thanks