News for hackers. Stuff that matters.

A comment on HTTPS is more secure, so why isn't the Web using it?. Parent comment

Re:HTTPS is more secure, so why isn't the Web using it? by drzaiusapelord on Monday March 21, 2011 @10:58AM (#2349995)
The problem is that there aren't enough IPv4 IP address for this. Each SSL cert requires an IP address. So if you have 200 sites on one virtual setup with one IP, only one of them can have the SSL. The connection needs to be established before Apache or IIS can be told what site to serve.

Maybe v6 will solve this, but right now you simply cannot do this. Or maybe the spec can be changed somehow (ask for host first then start SSL handshake?).

[ Parent | on HN ]
Re:HTTPS is more secure, so why isn't the Web using it? by duskwuff on Monday March 21, 2011 @05:52PM (#2351794)
> Or maybe the spec can be changed somehow (ask for host first then start SSL handshake?).

SNI does exactly this. Sadly, MSIE doesn't support it under Windows XP (and earlier), so we have to live without it for a while longer.

[ Parent | on HN ]