Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

blog.benroux.me

Post reply on HN
Print view View original

61–70 of 76 posts

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#61

Post by tokenizerrr »

Jaruzel wrote: post #58
zeta0134 wrote: post #44

Earlier quoted context omitted.

I was under the impression that older clients wouldn't send the host header over HTTPS, making it impossible to determine the correct certificate to serve in a shared IP environment. Modern browsers all support SNI which prevents exactly this problem, but compromise by sending the hostname in plain text, which may be a privacy concern; this is something that's still up for debate: http://security.stackexchange.com/qu…

SNI doesn't work on Windows XP. "Who still use Windows XP?" I hear you ask? Just under 10% of all users[1]. Enough to make SNI problematic. In a few years time, we'll be OK, but not right now. --- [1] https://www.netmarketshare.com/operating-system-market-share...

On internet explorer on Windows XP. Anyone on XP who uses Chrome or Firefox is just fine. If you are still using internet explorer on XP then you probably have other problems from all the malware that already installed itself on your computer.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#62

Post by Jaruzel »

tokenizerrr wrote: post #61
Jaruzel wrote: post #58

Earlier quoted context omitted.

SNI doesn't work on Windows XP. "Who still use Windows XP?" I hear you ask? Just under 10% of all users[1]. Enough to make SNI problematic. In a few years time, we'll be OK, but not right now. --- [1] https://www.netmarketshare.com/operating-system-market-share...

On internet explorer on Windows XP. Anyone on XP who uses Chrome or Firefox is just fine. If you are still using internet explorer on XP then you probably have other problems from all the malware that already installed itself on your computer.

Current versions of Chrome are no longer available for XP.

If you are still using XP it's probably because you have to, and do not have the knowledge to switch to something better. Ergo, it's highly possible that you are still using IE on XP as well, as you don't know any different, or cannot change it due to restrictions, or policy.

It's an accessibility thing. If I designed a new web system that blocked off 10% of the populous, for whatever reason (deaf,blind, not able bodied), then people would call me out on it.

In the main, it's unlikely that anyone still using XP is doing so because they want to. Not everyone is privileged enough to have access to modern equipment.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#63

Post by manarth »

Jaruzel wrote: post #62
tokenizerrr wrote: post #61

Earlier quoted context omitted.

On internet explorer on Windows XP. Anyone on XP who uses Chrome or Firefox is just fine. If you are still using internet explorer on XP then you probably have other problems from all the malware that already installed itself on your computer.

Current versions of Chrome are no longer available for XP. If you are still using XP it's probably because you have to, and do not have the knowledge to switch to something better. Ergo, it's highly possible that you are still using IE on XP as well, as you don't know any different, or cannot change it due to restrictions, or policy. It's an accessibility thing. If I designed a new web system that blocked off 10% of…

  It's an accessibility thing. If I designed a new web system that
  blocked off 10% of the populous, for whatever reason (deaf,blind,
  not able bodied), then people would call me out on it.
Rightly so, because that's a constraint that cannot be changed.

Running an outdated, decommissioned operating system is something that can be changed. You have no obligation, moral or otherwise, to support Windows 3.1, OS2/Warp, WAP browsers, Gopher clients, or IE5 running on Mac OS 9.

You can still choose to support outdated clients, because it makes financial sense for your organisation - and many places to just that - just as a corporation running outdated software may choose not to update because that's what makes financial sense for them.

Equating support for an accessible service with support for outdated browsers is a non-starter.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#64

Post by tokenizerrr »

Jaruzel wrote: post #62
tokenizerrr wrote: post #61

Earlier quoted context omitted.

On internet explorer on Windows XP. Anyone on XP who uses Chrome or Firefox is just fine. If you are still using internet explorer on XP then you probably have other problems from all the malware that already installed itself on your computer.

Current versions of Chrome are no longer available for XP. If you are still using XP it's probably because you have to, and do not have the knowledge to switch to something better. Ergo, it's highly possible that you are still using IE on XP as well, as you don't know any different, or cannot change it due to restrictions, or policy. It's an accessibility thing. If I designed a new web system that blocked off 10% of…

> Not everyone is privileged enough to have access to modern equipment.

And there you go. If you can't be bothered to not use an ancient operating system, that's just too bad. I don't care about people running DOS either.

Luckily it is a lot easier to switch to a modern operating system than to replace nonfunctional parts of the human body.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#65

Post by Dylan16807 »

pilom wrote: post #23
caleblloyd wrote: post #2

This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni

Unfortunately for our ecommerce site this just isn't the at all an option. 3 months ago we analysed our traffic and found that 12% of our desktop traffic didn't support it (Win XP) and about 8% of our mobile traffic didn't support it (Android older than 4.0). I'm not losing 10% of my revenue just so I don't need to get a couple extra IPs from AWS. And even better, AWS doesn't actually charge me for the IPs. Once IPs…

Hang on. What percent is XP, and what percent is IE on XP? Those are not numbers that should be conflated.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#66

Post by z3t4 »

liquidise wrote: post #5
caleblloyd wrote: post #2

This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni

(author here) I would have loved to have SNI work. I wrote this article in response to having profound struggles making it work. My iPhone 7's Safari was routinely failing to connect to sites other browsers claimed were fine, when relying on SNI. The day i swapped over to IP-based connections, the problem resolved itself immediately. If there is something i am missing i would love to know what it is.

older version of wget and Java also doesn't support SNI, for example used in API https callbacks, or Android apps. One trick I use it to load that site (or the most important) first in nginx, because those that doesn't support SNI will use that certificate.

Another option, if you don't need encryption, is to allow http.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#67

Post by Maakuth »

ethernetsalad wrote: post #16
mholt wrote: post #10

Earlier quoted context omitted.

It must have been something else. Even Safari on iOS has supported SNI since iOS 4.0 (2010).

The only thing I've had SNI fail under (so far) had been Netscape Navigator 3.0 and at that point, does it really matter?

You might be talking about HTTP 1.1 Host header which allows vhosts for plaintext HTTP servers. SNI allows this to happen with TLS (HTTPS, etc.) servers.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#68

Post by anc84 »

devwastaken wrote: post #57
scrollaway wrote: post #32

Earlier quoted context omitted.

Also, plugging Caddy: https://caddyserver.com/ I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

I can never take caddy seriously until they get serious about updates and start working with linux packages. When you have to do this: https://gist.github.com/Jamesits/2a1e2677ddba31fae62d022ef8a... That means your webserver is not going to receive updates until you re-do this manually each time, which is dangerous and not at all something you should be using proffessionally.

It's the duty of distributions to pick up and package software. Maybe you could volunteer for the distro you use yourself? It is easier than one might think.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#69

Post by k1ns »

smarinov wrote: post #25
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

This is a solution if you don't care that anyone looking at the certificate would be able to directly see every single domain that you are hosting as part of your setup. Determined people would be still able to find it out, more or less, despite not having it handy in their web browser under the field for the certificate's Subject Alternative Name . However, there is nothing stopping you from issuing separate certifi…

> I have been using precisely Nginx to serve multiple HTTPS domains with certificates from Let's Encrypt since the first few weeks after it came out

This is what I do as well, so I became pretty confused when reading the article. I've had no problems running my personal sites (side projects, really) from one NGINX server using different Let's Encrypt certificates for each one.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#70

Post by ClashTheBunny »

liquidise wrote: post #5
caleblloyd wrote: post #2

This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni

(author here) I would have loved to have SNI work. I wrote this article in response to having profound struggles making it work. My iPhone 7's Safari was routinely failing to connect to sites other browsers claimed were fine, when relying on SNI. The day i swapped over to IP-based connections, the problem resolved itself immediately. If there is something i am missing i would love to know what it is.

Could you be having issues with ipv6?
Post reply on HN