undefined | Better HN

0 pointsicebraining12y ago0 comments

To connect to an HTTPS site without SNI, the IP can only host a single domain, so they can just block the whole (IP:443) combination without affecting any other site.

0 comments

cmircea12y ago

What if the IP is dynamic? Say an Azure Cloud Service.

mpyne12y ago

I think the problem is that you'd need a different X.509 certificate for TLS, for each and every single IP.

cmircea12y ago

The certificate is issued for the domain, not the IP.

j / k navigate · click thread line to collapse

0 pointsicebraining12y ago0 comments

To connect to an HTTPS site without SNI, the IP can only host a single domain, so they can just block the whole (IP:443) combination without affecting any other site.

0 comments

cmircea12y ago

What if the IP is dynamic? Say an Azure Cloud Service.

mpyne12y ago

I think the problem is that you'd need a different X.509 certificate for TLS, for each and every single IP.

cmircea12y ago

The certificate is issued for the domain, not the IP.

j / k navigate · click thread line to collapse