Re:Ask HN: When are we finally going to start defaulting to ...
by toomuchtodo on Wednesday December 18, 2013 @12:37AM
(#6926090)
1) Free SSL certificates: http://www.startssl.com/
2) The benefits of SSL far outweigh the inability to serve XP and Android 2.X clients. Use a dedicated IP if you can and its cost-effective, if not, use SNI.
Re:Ask HN: When are we finally going to start defaulting to ...
by dangrossman on Wednesday December 18, 2013 @12:40AM
(#6926097)
1) Not free for commercial use per their terms of service. You have to use their $59.90+ paid product.
2) No, the benefits of SSL do not "far outweigh" the cost of not being available at all. If 1 in 5 people can't reach your site, it doesn't matter how secure you are. That's about how much of the web you would be shutting out by deploying SNI today.
If those were reasonable choices to make, at least some companies would be making them, but not a single well-known site has done so.
Two of them:
(1) SSL certificates for public-facing sites (where you don't control the trusted CAs/certs) cost money. More money than many individuals with sites spend on their hosting.
(2) Because you need one IP address per domain to do SSL, which costs even more money. Most sites are on shared hosting where dedicated IPs are not even offered, and on VPS/dedicated hosting additional IPs cost extra.
There's not enough free IPv4 space available to switch every domain to SSL if we wanted to. It won't be until Windows XP and Android 2.x usage is much lower that we can start using SNI on public-facing websites, which would relieve us of the need for a separate IP per domain.
On a personal note, SSL can be really expensive even if you're willing to spend money on it. I run three sites that give users subdomains. To run SSL on the sites, I need three wildcard certificates that cost over $300 per year.