Understanding the Limitations of HTTPS
More than 50% of the websites found through HN at present do not require SNI.  Do you think this is also true of the https-enabled www as a whole?<p>SNI was introduced to address the problem of shared hosting with respect to SSL&#x2F;TLS.  In the not-too-distant past, SSL&#x2F;TLS required a dedicated IP address for each HTTPS-enabled website.  One certificate per IP address.<p>There are still many, many websites that satisfy that requirement.FN1  I know this because I use unpopular customised HTTPS clients and have SNI disabled by default.  I only enable it when necessary; I have automated this to happen automatically if I receive an SNI error.FN2  Most of the time, I get no such errors.<p>FN1. I am tired of articles which ignore this fact.  If one assumes that all HTTPS-enabled websites require SNI, then one is making an incorrect assumption.  For <i>users</i>, the current SNI implementation (sending hostname in plain text) is a problem; people are trying to fix it, as the blog mentions.  For <i>website owners</i> and <i>hosting providers</i>, current SNI implementation may not be a problem.  I am viewing SNI from the user perspective.  I respect other perspectives.<p>FN2.  Most of the sites requiring SNI are Cloudflare sites. As the blog mentions, unless the customer pays additional fees to use their own certificate, Cloudflare acts as a MITM and the user only sees Cloudlfares certificates, not the target websites.  This is HTTPS as between the user and Cloudflare, and then (hopefully) between Cloudflare and the target website. It is not HTTPS between the user and the target website.<p>Edit: Note, FWIW, I do not use third party DNS and in fact do not use recursive DNS at all.  I retrieve, store and update DNS data and serve it from localhost bound authoritative nameservers.  (I also encrypt DNS packets with CurveDNS in the home lab and with the few remote servers on the intenret that support DNSCurve.)  I wrote a custom &quot;non-recursive&quot; stub resolver (for speed not privacy) that outperforms a cold recursive cache.  It does not query root servers and minimizes queries to TLD servers and remote authoritative nameservers as it learns from previous answers and updates constant databases and zone files accordingly.  Over time, it sends <i>less</i> queries than a recursive cache.