Hacker News Reader

Comment by klapinat0r | Hacker News Reader

> requiring an IPv4 addy for each cert

Why not just offer HTTP and HTTPS on the same IP?

HTTP and HTTPS are served on different ports so using a single IP for both typically isn't an issue. The issue here is that HTTP allows you to host multiple sites from one IP address, whereas HTTPS can only deliver a single certificate per IP address. This requires 1 IP per SSLed hostname. SNI lets you send multiple certificates on one IP, but client support isn't good enough yet. Multi-name certificates work better but can be more expensive.

> but client support isn't good enough yet.

I'm aware of SNI (and rely on it myself), but haven't found it to be an issue yet.

As far as I can see it's IE < 7 and XP. How big can that market really be? http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers...

If it's the "some corporations require IE6" argument, then it sounds like it's a business, and should be able to charge for the extra IP needed. But maybe I'm just horribly modern.

Anything using Microsoft's built-in crypto support, will still not work, I have a .NET based application I am supporting on Windows XP which still doesn't support SNI.

Also, my sites that I would want to enable would be public sites ... ones that I don't charge for since they are mostly public sites (but I still want to protect credentials for people posting comments and the like). So charging for an extra IP is simply not an option.

Reply on news.ycombinator.com