Distribute Your Content With Amazon CloudFront

Re:Distribute Your Content With Amazon CloudFront by alecco on Tuesday November 18, 2008 @07:12AM (#368159)

They are doing a fine job, yep.

Something I couldn't find is support for SSL. That's key for CDN services.

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by briansmith on Tuesday November 18, 2008 @08:05AM (#368188)

Signing up for a SSL certificate using your own credentials and then letting a third-party distribute and use your private key on an arbitrary number of systems you have no control over is bordering on fraud.

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by zmimon on Tuesday November 18, 2008 @09:09PM (#369030)

Hold on, who says you are handing over the private key?

I would definitely like to use a CDN with SSL sites. I am happy for the domain to be amazon's (or cloudfront, whatever) signed with their cert, I just don't want the browser security to be broken by having non-SSL content on the page.

Is there something wrong with this?

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by briansmith on Tuesday November 18, 2008 @10:15PM (#369078)

Mixing objects signed by different certs works the same way as having non-SSL content on the page.

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by alecco on Tuesday November 18, 2008 @12:56PM (#368472)

We are talking about a cloud service and the same company's CDN system. They already would have said certificates running possibly in multiple hosts. How do you get to "bordering on fraud" from there?

FAIL (Because of your reply tone, please try to be more civilized next time, shame on your up-voters too.)

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by briansmith on Tuesday November 18, 2008 @03:09PM (#368643)

If I give my certificate that says "this is Brian Smith" to Amazon, and then Amazon uses it to claim to be me, then that is very misleading. It is very similar to me giving my driver's license to my underage brother so he can buy me beer.

If CloudShare used its own "this is Amazon.com's Cloudshare Service" certificate then it might be okay, except (1) they would be using it to sign content that they haven't verified the authenticity of, which is misleading (like notarizing something without any authentication), and (2) you almost always need to mix those static assets with dynamic assets or HTML forms and that all has to happen on the same domain--the domain that receives the POST requests, not the CDN's domain--in order for things to work reliably.

As for tone: the tone with which I wrote my reply is apparently not the same as the tone with which you read it.

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by alecco on Tuesday November 18, 2008 @03:30PM (#368673)

No (x3)

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by icey on Tuesday November 18, 2008 @03:32PM (#368676)

FAIL (Because of your reply tone, please try to be more civilized next time, shame on your up-voters too.)

Not everyone is interested in making sure your feelings don't get hurt on the internet. The sooner you realize that, the better off you'll be.

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by rmaccloy on Tuesday November 18, 2008 @07:16AM (#368163)

Is it? Most of the use cases I can think of don't require SSL at all.

FWIW, I always found dealing with Akamai and HTTPS a bear.

[ Parent | on HN ]

Re:Distribute Your Content With Amazon CloudFront by alecco on Tuesday November 18, 2008 @07:41AM (#368177)

Well, one of the most common problems are the images at the basket step(s) on SSL with usually low cache hit [ratio]. Servers end up doing routing for static content and backend content, adding complication to the architecture and for content editors. If you can place the images on SSL on the CDN it is much easier and you need less content servers.

The details vary significantly on each scenario. But as a global service I think Amazon will eventually have to add SSL, IMHO.

[ Parent | on HN ]