Hacker News Reader

As far I know the only thing that works reliably is to get multiple IPs and multiple (wildcard) SSL certificates. You can try to save a little money by getting startssl certificates (free) or by using SSL host headers (multiple SSL on one IP address), but it doesn't work on all browsers so you end up wasting time explaining to your customers why they get an error when they access their site.

View on HN

What is "SSL host headers"? Is it wildcard certs, as Microsoft describes them on http://www.microsoft.com/technet/prodtechnol/WindowsServer20... ?

I think he meant "Server Name Indication" https://en.wikipedia.org/wiki/Server_Name_Indication

If there is more than one site hosted on a single IP, the client sends a request for the SSL certificate. In the "old" way, the client didn't say to which domain it wants to connect (it only told that after the SSL connection was established), so the server didn't know which certificate to send.

The problem has been solved with SNI, but it isn't universally supported (yet), though we are close (namely IE on XP). With SNI the client basically sends the server to which domain it wants to open a secure connection, so the server can serve the correct certificate.

Reply on news.ycombinator.com