> http://wiki.cacert.org/VhostTaskForce
> http://en.wikipedia.org/wiki/Server_Name_Indication

Yeah i had read that before and a similar one here [1], but what bugs
me is the browser support for SSLv3/TLS SNI:
* Mozilla Firefox 2.0 or later
* Opera 8.0 or later (the TLS 1.1 protocol must be enabled)
* Internet Explorer 7 (Vista, not XP) or later
* Google Chrome (Vista, not XP)
* Safari 3.2.1 Mac OS X 10.5.6

I doubt anyone still uses FF 2.0, but the others will cause problems.
I'd like to avoid relying on browser compatibility, hence my post. I
don't want to use one general cert for multiple sites, i want one cert
per site; and no wildcard [2].

So, do i have to use mutiple ssl ports? And if yes, should/scould i
just rewrite them out or would the users running IE6 or 7 on XP have
to see https://www.mysite.com:998877 instead? Could i have nginx remap
:998877 to :433 (i.e. omitting it) once the session had been
established?

[1] http://www.ruby-forum.com/topic/186664#815197
[2] http://www.linuxquestions.org/questions/linux-server-73/juggling-http-and-https-content-for-multiple-virtual-hosts.-755949/

--
() ascii-rubanda kampajno - kontraŭ html-a retpoŝto
/\ ascii ribbon campaign - against html e-mail