Ask HN: Why don't we see more HTTPS? Is CPU an issue?

Re:Ask HN: Why don't we see more HTTPS? Is CPU an issue? by trezor on Thursday September 10, 2009 @03:10PM (#815929)

For HTTPS you need a dedicated IP since security negotiation happens before the HTTP hosts header is posted and your cert needs to cover the host you want to connect to. That is, it is impossible to host several sites using HTTPS on one single IP. HTTPS using SSL (instead of for instance TLS) means that this is a limitation built into HTTPS itself and can't be mitigated.

With the current shortage on IPv4 IPs and most shared hosters trying to squeeze as many websites as possible onto the same single IP, that effectively means that getting a site up and running with HTTPS (and that is not even mentioning the cost of getting a properly signed certificate) is very, very costly and hard compared to regular HTTP hosting.

Until IPv6 goes mainstream don't expect any of this to change.

[ Parent | on HN ]

Re:Ask HN: Why don't we see more HTTPS? Is CPU an issue? by agl on Thursday September 10, 2009 @03:19PM (#815950)

SNI (Server name indication)[1] is designed to fix this. It's a TLS extension which lets the server know the hostname that the client is expecting. It can then reply with the correct certificate.

However, I note from the Wikipedia page that XP doesn't support this (!). I had thought this a solved problem :(

[1] http://en.wikipedia.org/wiki/Server_Name_Indication

[ Parent | on HN ]

Re:Ask HN: Why don't we see more HTTPS? Is CPU an issue? by revicon on Thursday September 10, 2009 @07:22PM (#816427)

Reading everyone's reasons for not implementing SSL, I'm wondering, how do you handle user logins? I'm building a site right now, and I need to create user accounts, and allow them to login with a username/password. Seems irresponsible to have them pass their password as cleartext when they log in. What do you do instead?

[ Parent | on HN ]

Re:Ask HN: Why don't we see more HTTPS? Is CPU an issue? by donw on Thursday September 10, 2009 @03:22PM (#815959)

If you're like most newer startups that have their customers under a TLD (foo.mycorp.com, bar.mycorp.com), you can use wildcard SSL to manage the problem. Otherwise, yeah, you're looking at one IP per TLD.

[ Parent | on HN ]

Re:Ask HN: Why don't we see more HTTPS? Is CPU an issue? by kdw on Thursday September 10, 2009 @03:51PM (#816038)

Am I correct in thinking that a wildcard only gets you one level deep? e.g. that *.mycorp.com matches "foo.mycorp.com" but not "foo.bar.mycorp.com"?

[ Parent | on HN ]

Re:Ask HN: Why don't we see more HTTPS? Is CPU an issue? by bensummers on Thursday September 10, 2009 @05:15PM (#816212)

Depends on the browser, which in practice means just one level deep.

[ Parent | on HN ]