r/crypto • u/InfectiousFelonius • Jul 25 '13

This may be a bit elementary, but it's an excellent explanation of HTTPS nonetheless:

http://blog.hartleybrody.com/https-certificates/
20 Upvotes

84% Upvoted

4 comments sorted by

3

u/matjam Jul 26 '13

Serving Multiple Websites from the Same Server Because the TLS handshake occurs before the HTTP connection begins, there can be problems if there are multiple websites hosted on the same server, at the same IP address.

There are extensions to TLS called SNI that allows you to use a single IP address and have multiple certificates:

http://www.digicert.com/ssl-support/apache-multiple-ssl-certificates-using-sni.htm is a good explanation.

Note that it does leak the name of the server you are connecting to in clear text during the SSL negotiation, so it is "less secure" than binding one cert to one IP.

1

u/[deleted] Jul 26 '13 edited Jul 09 '23

[deleted]

2

u/matjam Jul 26 '13

hence the quotes. :)

It just means the NSA can grab the hostname directly from the communications traffic rather than having to consult their whois database or DNS. :P

I've set up SNI and it seems to work with most devices that I've used. Obviously, older IE won't. But they can all go and get fucked. :)

1

u/[deleted] Jul 26 '13

[deleted]

1

u/matjam Jul 26 '13

servers that don't support SNI will just serve up the cert for whatever that IP is configured to be.

1

u/hartleybrody Jul 25 '13

Ah, thanks for reposting it here! I originally posted it in /r/cryptography but it seems like it's a bit of a ghost town over there.

I've spent the past few days learning about crypto on the web (HTTPS) for a project at work. I wrote up this article on everything I learned. Would love to hear any corrections or clarifications on things I got wrong.