Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

aws.typepad.com

Post reply on HN
Print view View original

21–30 of 31 posts

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#21

Post by rsanders »

psychometry wrote: post #8
pfg wrote: post #2

Pricing, since it's not explicitly mentioned in the blog post: You pay $600 per month for each custom SSL certificate associated with one or more CloudFront distributions. This monthly fee is pro-rated by the hour. For example, if you had your custom SSL certificate associated with at least one CloudFront distribution for just 24 hours (i.e. 1 day) in the month of June, your total charge for using the custom SSL cert…

Jesus. I served 5 TB of video on a site with Cloudfront last month and it was cheaper than that. I'll stick with my uglyrandomletters.cloudfront.net domain.

The (theoretical) security value of proving a secure connection to uglyrandomletters.cloudfront.net is significantly less than the value of proving a secure connection to TheSiteYouTrust.com.

When a group of U.S. ISPs first started working on anti-phishing solutions, we realized that the problem with SSL is that apparently nobody told users they needed to check anything but the golden lock icon to verify security. "Oh, look, I have a secure connection to bankofamerica.b1llingprovider.com, seems legit".

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#22

Post by adrr »

stellar678 wrote: post #7

Any ideas on how they accomplish this? I presume it means that when I upload an SSL cert and associate it with one (or more) cloudfront distribution, that Amazon ends up dedicating at least one IP address at every edge location solely to my SSL cert? I guess the scarcity of IP address space explains the steep pricing? They want you to consider other options before asking to reserve 40 dedicated IP addresses.

Couldn't they do it with 1 IP and use anycast instead of DNS to route to the edges?

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#23

Post by legutierr »

donavanm wrote: post #16
legutierr wrote: post #12

Earlier quoted context omitted.

I'm curious, in addition to a lack of compatibility with Windows XP and early versions of certain browsers, is there any other reason that one wouldn't want to use SNI?

theres the (lack of) security when the client advertises the expected cert cn outside of the secure session. bu the real reason is simply client support. last i looked about 50% of requests looked like they came from clients that didnt support sni. suppose a ridiculously optimistic estimate of 90% support. is it acceptable for 10% of your clients to have security warnings when visiting your site? that's an unacceptab…

I'd be curious to know what the actual numbers are...IE 7 even supports SNI, as long as it is running on Vista+. I've seen stats that say XP usage is near 15% now, and some portion of that must include non-IE browsers, so perhaps 10% might be an accurate estimate? When you "last looked", where did you find that 50% stat?

With regards to the security hole, do you mean to say that having the domain name sent in the clear before the secure session is established is the problem? Other than some narrow privacy concerns, I can't see the real issue here, given that most of the time a certain IP address implies a certain domain name, and the destination IP address needs to be sent in the clear.

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#24

Post by saurik »

ceejayoz wrote: post #9
cperciva wrote: post #4

Earlier quoted context omitted.

You pay $600 per month for each custom SSL certificate associated with one or more CloudFront distributions. This is... impressively expensive.

Not when you think about what's going on behind the scenes. There are 40 CloudFront datacenters, which means all 40 of them have to have a dedicated IP and setup just for you and your SSL certificate.

The way that many CDNs do this is to use a certificate with multiple names for many of their clients in clusters. Check the certificate on https://cydia.saurik.com/ for an example of this.

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#25

Post by jread »

adrr wrote: post #22
stellar678 wrote: post #7

Any ideas on how they accomplish this? I presume it means that when I upload an SSL cert and associate it with one (or more) cloudfront distribution, that Amazon ends up dedicating at least one IP address at every edge location solely to my SSL cert? I guess the scarcity of IP address space explains the steep pricing? They want you to consider other options before asking to reserve 40 dedicated IP addresses.

Couldn't they do it with 1 IP and use anycast instead of DNS to route to the edges?

CloudFront doesn't use Anycast for content routing - only the DNS side is Anycast

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#26

Post by Jamiecon »

cperciva wrote: post #14
ceejayoz wrote: post #9

Earlier quoted context omitted.

Not when you think about what's going on behind the scenes. There are 40 CloudFront datacenters, which means all 40 of them have to have a dedicated IP and setup just for you and your SSL certificate.

If they're not using SNI I agree that it would be expensive... not necessarily that expensive, though. Elastic IP addresses cost $0.005/hour, which is about $3.60/month; multiply that by 40 datacenters and you've got $144/month worth of IPs, not $600.

Problem with SNI is that you lose IE users on XP. In the UK at least, that means entire organisations with thousands of employees such as Lloyds bank and the NHS. According to our stats anyway.

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#27

Post by buro9 »

pfg wrote: post #2

Pricing, since it's not explicitly mentioned in the blog post: You pay $600 per month for each custom SSL certificate associated with one or more CloudFront distributions. This monthly fee is pro-rated by the hour. For example, if you had your custom SSL certificate associated with at least one CloudFront distribution for just 24 hours (i.e. 1 day) in the month of June, your total charge for using the custom SSL cert…

CloudFlare ( https://www.cloudflare.com/ ) are going to be getting a lot of new customers very soon I suspect.

Not least because they intend to give SSL to everyone (even the free tier) very soon, and have acquired enough IPv4 addresses to make doing so possible. Additionally their price for custom SSL certificates is a fraction of the price of CloudFront.

It is strange, watching a company like Amazon make a pricing decision like this, knowing how it will then shift things.

In our startup ( http://microco.sm ), we are implementing S3 for storage, and then to use multiple reverse proxies that make our static files surface (with our sites) through CloudFlare. The best of both worlds.

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#28

Post by ceejayoz »

saurik wrote: post #24
ceejayoz wrote: post #9

Earlier quoted context omitted.

Not when you think about what's going on behind the scenes. There are 40 CloudFront datacenters, which means all 40 of them have to have a dedicated IP and setup just for you and your SSL certificate.

The way that many CDNs do this is to use a certificate with multiple names for many of their clients in clusters. Check the certificate on https://cydia.saurik.com/ for an example of this.

That's a no-go for a lot of corporate users, though.

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#29

Post by [deleted] »

buro9 wrote: post #27
pfg wrote: post #2

Pricing, since it's not explicitly mentioned in the blog post: You pay $600 per month for each custom SSL certificate associated with one or more CloudFront distributions. This monthly fee is pro-rated by the hour. For example, if you had your custom SSL certificate associated with at least one CloudFront distribution for just 24 hours (i.e. 1 day) in the month of June, your total charge for using the custom SSL cert…

CloudFlare ( https://www.cloudflare.com/ ) are going to be getting a lot of new customers very soon I suspect. Not least because they intend to give SSL to everyone (even the free tier) very soon, and have acquired enough IPv4 addresses to make doing so possible. Additionally their price for custom SSL certificates is a fraction of the price of CloudFront. It is strange, watching a company like Amazon make a pricing…

[deleted]

Re: Custom SSL Domain Names and Root Domain Hosting for Amazon CloudFront

#30

Post by ceejayoz »

buro9 wrote: post #27
pfg wrote: post #2

Pricing, since it's not explicitly mentioned in the blog post: You pay $600 per month for each custom SSL certificate associated with one or more CloudFront distributions. This monthly fee is pro-rated by the hour. For example, if you had your custom SSL certificate associated with at least one CloudFront distribution for just 24 hours (i.e. 1 day) in the month of June, your total charge for using the custom SSL cert…

CloudFlare ( https://www.cloudflare.com/ ) are going to be getting a lot of new customers very soon I suspect. Not least because they intend to give SSL to everyone (even the free tier) very soon, and have acquired enough IPv4 addresses to make doing so possible. Additionally their price for custom SSL certificates is a fraction of the price of CloudFront. It is strange, watching a company like Amazon make a pricing…

Why would people switch to CloudFlare because Amazon added a feature Amazon never offered?
Post reply on HN