Timeline for Why do HTTPS requests include the host name in clear text?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 24, 2015 at 8:00 | comment | added | m3nda | "For a Web site hosting service, this would mean buying a new certificate whenever a customer registers". Is you kidding me? I was guessing that wildcard SSL allow ANY string under the main domain, but just at 1st level with *domain.com ( IE: 1st.main.com, 2st.1st.main.com) | |
| Apr 24, 2015 at 4:38 | comment | added | Steffen Ullrich | @JoshvonSchaumburg: The server does not know and would either provide the default certificate of the site (which will result in rejection by the browser because of name-mismatch) or return an "unknown_name" alert or something like this. | |
| Apr 23, 2015 at 23:45 | comment | added | jay-charles | Good explanation. So if I were still using IE on XP and navigated to an HTTPS site on a server hosting multiple HTTPS sites with multiple certs, how would the server know which cert to provide without SNI support? | |
| Apr 23, 2015 at 19:04 | history | answered | Tom Leek | CC BY-SA 3.0 |