Why not use HTTPS for everything?

by

In addition to the other reasons (especially performance related) you can only host a single domain per IP address* when using HTTPS.

A single server can support multiple domains in HTTP because the Server HTTP header lets the server know which domain to respond with.

With HTTPS, the server must offer its certificate to the client during the initial TLS handshake (which is before HTTP starts). This means that the Server header hasn’t been sent yet so there is no way for the server to know which domain is being requested and which certificate (www.foo.com, or www.bar.com) to respond with.

*Footnote: Technically, you can host multiple domains if you host them on different ports, but that is generally not an option. You can also host multiple domains if your SSL certificate is has a wild-card. For example, you could host both foo.example.com and bar.example.com with the certificate * .example.com

More Related Contents:

  1. How to redirect all HTTP requests to HTTPS
  2. Are querystring parameters secure in HTTPS (HTTP + SSL)? [duplicate]
  3. Will web browsers cache content over https
  4. Are HTTPS headers encrypted?
  5. With HTTPS, are the URL and the request headers protected as the request body is?
  6. Username and password in https url
  7. If you use HTTPS will your URL params will be safe from sniffing? [duplicate]
  8. Should I hash the password before sending it to the server side?
  9. https URL with token parameter : how secure is it?
  10. Is it secure to submit from a HTTP form to HTTPS?
  11. SSL Error: unable to get local issuer certificate
  12. Is HTTP header Referer sent when going to a http page from a https page?
  13. curl – Is data encrypted when using the –insecure option?
  14. How to redirect all HTTP requests to HTTPS using .htaccess rules?
  15. WS on HTTP vs WSS on HTTPS
  16. What is token-based authentication?
  17. How secure is a HTTP POST?
  18. Payment Processors – What do I need to know if I want to accept credit cards on my website? [closed]
  19. What’s the right OAuth 2.0 flow for a mobile app
  20. Declaring Spring Bean in Parent Context vs Child Context
  21. How to prevent arbitrary client apps from using anonymous web API?
  22. Replay attacks for HTTPS requests
  23. What is the appropriate way to manage API secrets within a Google Apps script?
  24. SSO with CAS or OAuth?
  25. Best practices for server-side handling of JWT tokens [closed]
  26. How do I secure REST API calls?
  27. What are best practices for securing the admin section of a website? [closed]
  28. How can I hash passwords in postgresql?
  29. How do you protect code from leaking outside? [duplicate]
  30. Has Hardware Lock Elision gone forever due to Spectre Mitigation?

Leave a Comment