News for hackers. Stuff that matters.

A comment on CloudFlare, We Have a Problem. Parent comment

Re:CloudFlare, We Have a Problem by pfg on Saturday July 16, 2016 @02:41AM (#12105498)
There's no such thing as a SNI certificate. SNI is a TLS extension allowing clients to send the hostname as part of the Client Hello, which allows the server to pick the right certificate for the hostname being requested. Without SNI, you're essentially limited to one certificate per IP address (which is what makes things expensive for CDNs if you need to support clients without SNI).

CloudFlare's free plan uses SNI.

[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by true_religion on Saturday July 16, 2016 @05:26AM (#12105767)
Their $20/month plan appears to offer SAN, so you can support clients without SNI.
[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by pfg on Saturday July 16, 2016 @06:03AM (#12105828)
Their free plan uses SAN certificates too. The difference is that they do "one (shared) SAN certificate per IP" for paid plans, as opposed to "multiple (shared) SAN certificates per IP" on the free plan, which requires SNI to work.
[ Parent | on HN ]