Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

blog.benroux.me

Post reply on HN
Print view View original

71–76 of 76 posts

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#71

Post by ClashTheBunny »

zwetan wrote: post #55

"This means you cannot have multiple HTTPS sites hosted from the same IP address." Is that some kind of joke? Yes you can, unless you want to support very old browsers [0] which would defeat the whole purpose of using SSL/TLS in the first place. Maybe have a look at Mozilla Security/Server Side TLS [1] Also SSL certs are issued for FQDN, not IP addresses (unless the IP is public and owned but still it is considered d…

The article explains that SNI isn't working: > But while this is widely supported, it is not supported ubiquitously. I've personally had a hell of a time fighting with mobile browsers when relying on SNI. On the other hand, IP addresses are cheap. Like, $1/mo or less, cheap. So buck up and grab an distinct IP for your HTTPS sites. Avoiding the headache of some device/browser combos not working will pay for itself 100 times over.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#72

Post by mholt »

eicnix wrote: post #56
scrollaway wrote: post #32

Earlier quoted context omitted.

Also, plugging Caddy: https://caddyserver.com/ I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

How does Caddy compare to nginx performance wise? I have a similar setup like you running on nginx. For loadbalancers I mainly care about performance and not usability of the configuration language.

I hear this question a hundred different ways. What do you even mean by performance? There's so many dimensions to a web server.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#73

Post by mholt »

devwastaken wrote: post #57
scrollaway wrote: post #32

Earlier quoted context omitted.

Also, plugging Caddy: https://caddyserver.com/ I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

I can never take caddy seriously until they get serious about updates and start working with linux packages. When you have to do this: https://gist.github.com/Jamesits/2a1e2677ddba31fae62d022ef8a... That means your webserver is not going to receive updates until you re-do this manually each time, which is dangerous and not at all something you should be using proffessionally.

We will look into it after we hit 1.0.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#74

Post by zwetan »

ClashTheBunny wrote: post #71
zwetan wrote: post #55

"This means you cannot have multiple HTTPS sites hosted from the same IP address." Is that some kind of joke? Yes you can, unless you want to support very old browsers [0] which would defeat the whole purpose of using SSL/TLS in the first place. Maybe have a look at Mozilla Security/Server Side TLS [1] Also SSL certs are issued for FQDN, not IP addresses (unless the IP is public and owned but still it is considered d…

The article explains that SNI isn't working: > But while this is widely supported, it is not supported ubiquitously. I've personally had a hell of a time fighting with mobile browsers when relying on SNI. On the other hand, IP addresses are cheap. Like, $1/mo or less, cheap. So buck up and grab an distinct IP for your HTTPS sites. Avoiding the headache of some device/browser combos not working will pay for itself 100…

So that means you will use pre TLS v1.0 to support those browsers that can not deal with SNI.

You must feel very smart to be able to support old Android browsers like Gingerbread which represent 1% of the Android market share [0], and iOS pre v4.0 browsers which represent less than 0,1% of the iOS market share [1].

Now according to TLS/SSL support history of web browsers [2] your server is vulnerable to BEAST, POODLE, CRIME, etc.

Congrats your SSL cert is useless.

[0]: https://developer.android.com/about/dashboards/index.html

[1]: https://david-smith.org/iosversionstats/

[2]: https://en.wikipedia.org/wiki/Template:TLS/SSL_support_histo...

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#75

Post by liquidise »

zwetan wrote: post #74
ClashTheBunny wrote: post #71

Earlier quoted context omitted.

The article explains that SNI isn't working: > But while this is widely supported, it is not supported ubiquitously. I've personally had a hell of a time fighting with mobile browsers when relying on SNI. On the other hand, IP addresses are cheap. Like, $1/mo or less, cheap. So buck up and grab an distinct IP for your HTTPS sites. Avoiding the headache of some device/browser combos not working will pay for itself 100…

So that means you will use pre TLS v1.0 to support those browsers that can not deal with SNI. You must feel very smart to be able to support old Android browsers like Gingerbread which represent 1% of the Android market share [0], and iOS pre v4.0 browsers which represent less than 0,1% of the iOS market share [1]. Now according to TLS/SSL support history of web browsers [2] your server is vulnerable to BEAST, POODLE…

You are making incorrect assumptions and running with them.

As i stated in the article, and on this HN comment page, my issues were not with antiquated browsers. Safari on my iPhone 7 was failing to connect to sites other browsers were handling fine. I went down this rabbit hole of IP-based differentiation specifically because of that issue.

There seems to be some sense that i published an article about the hardest way to achieve this. I promise had relying on SNI worked liked i expected it to, the IP-based section of the article would be absent. But it didn't and, like i said, IP's are cheap. Adding 1 step to a process of ubiquitous support seems like a reasonable approach to me.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#76

Post by pilom »

Dylan16807 wrote: post #65
pilom wrote: post #23

Earlier quoted context omitted.

Unfortunately for our ecommerce site this just isn't the at all an option. 3 months ago we analysed our traffic and found that 12% of our desktop traffic didn't support it (Win XP) and about 8% of our mobile traffic didn't support it (Android older than 4.0). I'm not losing 10% of my revenue just so I don't need to get a couple extra IPs from AWS. And even better, AWS doesn't actually charge me for the IPs. Once IPs…

Hang on. What percent is XP, and what percent is IE on XP? Those are not numbers that should be conflated.

The vast majority of our users still on XP use IE. To the point that we conflate the numbers entirely. Most of those users are 50 year old women who have leftover computers handed down from relatives. They almost as a rule, don't install Chrome or Firefox on them, they just use what is currently on it.
Post reply on HN