I'm not sure if the OP referenced Win XP purely based on the IPv4->IPv6 discussion but Win XP is also extremely relevant for IP address space consumption due to not supporting TLS extension SNI [1].
SNI removes the requirement from HTTPS websites to host one domain per IP. This is done by having hostname part of the initial handshake.
Many websites or at least most (hopefully all) webapps these days serve over https, at least the ones that require user input like login. So there's the need for at least one public IP per site.
With SNI these could be all served from the same IP.
Now imagine CDN services like AWS CloudFront -- to support sites with SSL certificates you must use one IP per cert in EACH region or whatever the distribution granularity is.
Now this my friends is why AWS CloudFront asks $600/mo for each custom SSL cert domain and with SNI custom SSL it costs $0/mo.
As soon as all the 99.9% browsers/clients support SNI we'll be living in a better place with more free IPs. So we can finally distribute static content from CDN through custom SSL without the $600/mo pricetag.
It's naive to think everyone would go to SNI-based hosts with IPs shared with strangers but at least within the same datacenter for the same company IPs can be more easily conserved.
Yea, I should have been more specific. Chrome and Firefox DO have their own TLS with SNI and SNI is enabled for them in Win XP. The issue is relevant for all IE versions on WinXP.
Comments
I'm not sure if the OP referenced Win XP purely based on the IPv4->IPv6 discussion but Win XP is also extremely relevant for IP address space consumption due to not supporting TLS extension SNI [1].
SNI removes the requirement from HTTPS websites to host one domain per IP. This is done by having hostname part of the initial handshake.
Many websites or at least most (hopefully all) webapps these days serve over https, at least the ones that require user input like login. So there's the need for at least one public IP per site.
With SNI these could be all served from the same IP.
Now imagine CDN services like AWS CloudFront -- to support sites with SSL certificates you must use one IP per cert in EACH region or whatever the distribution granularity is.
Now this my friends is why AWS CloudFront asks $600/mo for each custom SSL cert domain and with SNI custom SSL it costs $0/mo.
As soon as all the 99.9% browsers/clients support SNI we'll be living in a better place with more free IPs. So we can finally distribute static content from CDN through custom SSL without the $600/mo pricetag.
It's naive to think everyone would go to SNI-based hosts with IPs shared with strangers but at least within the same datacenter for the same company IPs can be more easily conserved.
[1] http://en.wikipedia.org/wiki/Server_Name_Indication
Couldn't WinXP browsers (e.g. Chrome, Firefox) implement their own TLS with SNI?
At least Chrome 34 on Windows XP supports SNI; I strongly suspect that Firefox does as well (since they are both using the NSS library for SSL).
Firefox does, but only because it uses their own TLS library instead of using the one supplied by the OS.
Yea, I should have been more specific. Chrome and Firefox DO have their own TLS with SNI and SNI is enabled for them in Win XP. The issue is relevant for all IE versions on WinXP.