I understand the principle, but let's not get to philosophical about this: You ran reddit's servers and worked at netflix in their availability department. Cut out a morning coffee and you have enough money to run SSL.

SNI works with anyone on Windows > XP, and any mobile / Apple / Linux OS you'll find visiting your site. How many IE6/XP hits does your site get per month?

Even on Windows XP, it is only IExplorer that doesn't do SNI. Chrome or Firefox have no problem.

The bigger problem right now is Android 2.x. But the lifetime of phones is only about 2 years and the market-share of Android 2.x has dropped below 20%.

And it really depends on the audience. The market share of all IExplorer versions on my blog is less than 4%, out of which IExplorer 11 represents more than half of that.

> The bigger problem right now is Android 2.x. But the lifetime of phones is only about 2 years and the market-share of Android 2.x has dropped below 20%.

Below 10% even[1]. Agreed on device lifetime. Unlike PCs that can stick it out much longer, give it another year and it'll be well below IE6 levels. Can't come soon enough.

[1] https://developer.android.com/about/dashboards/index.html

The problem here is that increasing the difficulty or learning curve of a system is always unpopular.

If SSL was truley as trivial as a check box, then we would see very wide adoption.

>The problem is that costs 100 times as much as what I pay now

The "100 times as much" is not that impressive, if it merely goes from 6 cents to 6 dollars.

I suggest looking at the world beyond your immediate environs.

6 cents vs 6 dollars is the difference between a person in a low-income economy spending 0.1% vs 18% of their income on a website.

That works out to an income of about $33/mo. I think that person has a lot more to worry about than where to host their static site.

My source for that figure was the World Bank[1], which gives a GNI per capita of 400USD PA for the Democratic Republic of Congo.

[1]: http://data.worldbank.org/country/congo-dem-rep

Which in big chunks of the western world is not that much, but it will increase the barrier for entry for many in poorer nations. For commercial sites, then maybe I see a benefit. For everything else... why bother? The info isn't secret, doesn't need to be and since there's so much data going around already is anyone malicious bothering to look?

And what do you think that means for websites that are 100 times as big? They go from being rather cheap to host to being money drains.

We need better infrastructure.

Cloudflare provides a free ssl service.

A free MITM service, you mean.

With ECDSA only certificates, which are even less supported by old browsers than SNI.

NearlyFreeSpeech.net offers comparable value to S3, and you can use apache features like .htaccess for redirection. Only problem is that it's still SNI, if that's important for you.

Sounds like an opportunity for a startup if I've ever heard one.

Yeah, more nickel and diming.