Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I want to have all my content from my blog distributed in a ssl encrypted connection (meaning, I want to go https)

What are the drawbacks with respect to an unencrypted, "regular" http connection?

share|improve this question
1  
I have a certificate and I want to use it for something -- Are you sure it's a certificate you can use for web hosting? That's not something you get by accident... – Arjan Nov 5 '09 at 16:04
It was included in my web host upgraded package. I am using it to encrypt openid negotiation now, but I'd like to put everything under ssl. – Stefano Borini Nov 5 '09 at 16:07
4  
@Paul, why would that stop people. Even the browser in my very old mobile phone supports HTTPS. – Arjan Nov 5 '09 at 16:14
1  
I don't see people being stopped by amazon's ssl page.... – Stefano Borini Nov 5 '09 at 16:15
1  
@Paul: because, as I said, I am tired of hearing people saying that if you use encryption you are doing illegal stuff. I would actually encourage anyone else to do the same, but for now I'd settle with mine. – Stefano Borini Nov 6 '09 at 0:54
show 2 more comments

3 Answers

up vote 4 down vote
  • Slightly more server CPU usage (only relevant for big sites)
  • The first SSL handshake may take a second or two (further page loads can skip it)
  • One certificate per IP address (because they're exchanged before sending any data - so the Host HTTP header cannot be used.
    • SNI allows using multiple certificates per IP address, but not all HTTP servers and clients* support it yet. (For example, on Debian 5 with Apache2, you need to switch to mod_gnutls, or compile mod_ssl manually.)
  • If your certificate is self-signed, it can become really annoying for visitors.
  • Same if any of your images/stylesheets/scripts are loaded over plain HTTP.

(* wget and curl can't really be called "browsers")

share|improve this answer
1  
Although wget and curl may not be called "browsers", IE on WinXP usually does. – innaM Nov 5 '09 at 16:44
1  
Regarding "slightly more". – grawity Oct 16 '11 at 13:38
up vote 2 down vote

The only two I can think of is it slightly slower and makes a higher load on the server.

share|improve this answer
up vote 2 down vote

It will depend what your blog actually does. For example, are you including images from other sites? Are https-URIs for those images available? If not, you will end up with browsers complaining about insecure content.

May I ask why you are considering https?

share|improve this answer
2  
because I have a certificate and I want to use it for something. Also, I am tired of hearing people saying that only banks and illegal stuff use encryption. – Stefano Borini Nov 5 '09 at 15:15
good point for the included stuff. hmmmm.... it can be annoying I guess. any opinion about this point ? – Stefano Borini Nov 5 '09 at 15:26
1  
IMHO it's a real show stopper. People don't want to be annoyed by stuff like that. Of course, you can always host this stuff on your site (I guess). – innaM Nov 5 '09 at 15:30
no, I embed images from the pedia... this is annoying. :( – Stefano Borini Nov 5 '09 at 15:33
So I have a certificate and don't know what to do with it ... so sad. – Stefano Borini Nov 5 '09 at 15:33
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.