Re:Let's Encrypt Launch Schedule
by adisbladis on Tuesday June 16, 2015 @01:00PM
(#9727217)
SNI has been a thing for a long while now..
Do you seriously need to support older browsers than this? https://en.wikipedia.org/wiki/Server_Name_Indication#Web_bro...
Re:Let's Encrypt Launch Schedule
by LinuxBender on Tuesday June 16, 2015 @04:15PM
(#9728438)
SNI is fine for web browsing, but for end-points that need to be reachable by older versions of python, tomcat, ruby and many proprietary apps, this will not suffice. This becomes a problem on business to business communications, automation, API's, etc. For the general purpose websites, blogs, etc, SNI would be fine.
You're probably talking about really old versions of applications. I've been using SNI for half a decade without any issues.
Anything so old that does not support SNI probably still uses SSLv3, or maybe even SSLv2, so you really should be upgrading that ASAP, rather than keep supporting it.
Re:Let's Encrypt Launch Schedule
by LinuxBender on Friday June 26, 2015 @04:35PM
(#9787577)
If you take a look at the wiki article, there are some versions listed. Those are still in use. If our company forced people to use SNI, we would be out of business. There are TLS 1.0+ enabled apps that can't do SNI. Perhaps you and I are just in very different business models.
Re:Let's Encrypt Launch Schedule
by JoshTriplett on Tuesday June 16, 2015 @01:07PM
(#9727268)
> But for me the biggest problem with adoption of SSL is still that every domain name needs it's unique IPv4 address, and all problems that come with that, not registering or paying for the SSL certificate.
Only if you care about IE on Windows XP (which is no longer supported and no longer gets security updates) or Android phones more than 4 years old (2.3 Gingerbread and older). SNI works fine on other devices.
Have you measured? Do you have numbers for how many users you have running one of those two environments?
New phones are still being sold with Android 2.3 here [1] in Ecuador (which is ridiculous), so for some markets you do need to verify what your target audience uses before making assumptions like that.
[1] http://www.movistar.com.ec/tienda/Marcas/Huawei/Huawei-Y210/...
Re:Let's Encrypt Launch Schedule
by icebraining on Wednesday June 17, 2015 @03:38AM
(#9730470)
What's depressing is that 2.3 already had an API that would use SNI, but they didn't update the stock browser to use it :|
Re:Let's Encrypt Launch Schedule
by JoshTriplett on Wednesday June 17, 2015 @11:23AM
(#9732414)
That's exactly why I asked about measurement; just because such users exist doesn't mean they use your site, or buy anything from it.
Use SNI, Server Name Indication: https://en.wikipedia.org/wiki/Server_Name_Indication
All modern browsers support it, as do Nginx and Apache.
Thanks for the info, eirst time I hear about this. I'll look it up. I'm honestly a bit ashamed I haven't heard about this before.
With many platforms you can also use a Multi-Domain certificate to use one Certificate with one IP. Let's Encrypt will support Multi-Domain certificates.
But for me the biggest problem with adoption of SSL is still that every domain name needs it's unique IPv4 address, and all problems that come with that, not registering or paying for the SSL certificate.
At work, I usually use virtual hosting for about 100 domains on one IP address. I don't see us buying an IPv4 address per domain and adding them to my NIC configuration one by one. Once we can safely ignore IPv4 and use IPv6 only it will probably become easier and cheaper.