Re: www.spi-inc.org uses an invalid security certificate

On 02 Mar 2014, at 18:02, Jeremy Baron <jeremy(at)tuxmachine(dot)com> wrote:
> On Feb 27, 2014 6:46 PM, "TJ" <spi-inc(at)iam(dot)tj> wrote:
> > Most sites and browsers support SNI in which case multiple IPs aren't required, although to
> > handle those user agents that don't support SNI it is usual to make the server's default site
> > be the primary HTTPS site for the organisation.
>
> I thought the point of using multiple IPs was to allow one to accept HTTPS and one to not listen to 443 at all. (Not something you can do with SNI…)
>

The point of multiple IPs is to allow you to use multiple SSL certificates, since SNI is nice but in the real world still unusable due to the large number of people still using Windows XP which does not support SNI. SPI does not have extra IP addresses to spare as far as I know, and an ISP is not likely to give you extra IP space if your rationale is “I want to serve sites without SSL”.

Randomly trying to access a site by changing a HTTP url to HTTPS one is likely to result in problems. SPI is not unique in that aspect.

Wichert.