I am aware that this was true in the past (a countryside ATM booth tried to lock me in at 6:00PM 11 years ago) but can you list any recent examples of this (bank names, ATM locations)?
I was there in January this year and did not encounter this at all. The worst was an "after hours" fee of a few hundred yen at a Mitsubishi UFJ foyer ATM (after 10:00 PM IIRC).
TL;DR; SSL would be used for all traffic but non-SNI browsers would be served from the origin server or a caching server. URLs would be rewritten in JS in the browser on first hit.
Thanks for replying. Below are the details:
I work on an e-commerce project where 50% of bandwidth, a few hundred GB per month, is thumbnails and CSS. We currently serve this over HTTP on CloudFront - primarily for faster page rendering.
CloudFront and on-server caching are also helpful in handling traffic spikes from Reddit etc.
Total hosting cost is under $500/month so $600/month for CloudFront custom SSL hosting is steep in comparison.
My question was considering a scenario where we might switch to SSL all the time.
The main server would be at https://ssl.domain.com. This serve dynamic content to all visitors, static content to non-SNI browsers and is the CloudFront origin.
If non-SNI traffic was too much for the origin server we would set up a caching server (e.g. Nginx/Varnish on https://sslcache.domain.com) and rewrite non-SNI traffic there instead of the origin.
In the browser a javascript snippet would try to connect to https://sni.domain.com by loading a 1 pixel image then write the URLs in the DOM if a short timeout delay was exceeded and set a cookie for further requests by this browser. The cookie would then determine if the server delivered pages (usually from the cache) with SNI or non-SNI URLs for static content.
I think this would work and would see at least 90% of static resources served over SNI.
It would be nice if there was a more elegant way detect non-SNI browsers - such as a JS test for the existence of a particular browser property - rather than trying to load from CloudFront (seems a bit web 1.0ish).
Personally I can relate to Kent Beck's approach to testing rather than "test everything":
"I get paid for code that works, not for tests, so my philosophy is to test as little as possible to reach a given level of confidence (I suspect this level of confidence is high compared to industry standards, but that could just be hubris). If I don't typically make a kind of mistake (like setting the wrong variables in a constructor), I don't test for it. I do tend to make sense of test errors, so I'm extra careful when I have logic with complicated conditionals. When coding on a team, I modify my strategy to carefully test code that we, collectively, tend to get wrong."
Does anyone know an elegant way to sniff browser support for SNI?
Using JS to load an element from the SNI domain and then rewriting URLs if the response is too slow would probably work but surely there are better methods.
I was there in January this year and did not encounter this at all. The worst was an "after hours" fee of a few hundred yen at a Mitsubishi UFJ foyer ATM (after 10:00 PM IIRC).