Hacker News Reader

Comment by newjersey | Hacker News Reader

Is there a good reason why squarespace can't enable https at least for those who "buy" their domain names from squarespace as well? It shouldn't cost squarespace any significant amount of money, should it?

And yet https://support.squarespace.com/hc/en-us/articles/205815898-...

View on HN

(Founder/CEO of Squarespace here)

Hey all -- it's actively being worked on and will arrive soon. As someone on this thread correctly pointed out, it's a complex implementation due to how our infrastructure is set up.

My understanding (I talked to them about it a year ago) was they have to do some work on making a big SNI-based load balancer that works with their current network setup.

Plus: lazy loading certs and the appropriate key management infrastructure to support it.

HAProxy does this out of the box. They should be all over this IMHO.

Of course, but I don't think they're using a generic LB / terminator and while they could move to one, it'd still take a long time to migrate on their scale

Depends on how they've built their stack. At a guess I'd say if it was easy for them to do it, they would already have done it - at least offering it as a premium upgrade.

If they're both the host and the domain registrar, couldn't they simply point dns to a different set of servers where they host the https keys and then send traffic to the real server which hosts the websites? Is it a performance issue?

Even amazon.com serves over https now...

I have no idea why they haven't done it, and agree that for some stacks it would be easy. But there are some stacks where it would be really difficult because of small details.

Reply on news.ycombinator.com