Search code examples
sql-serverazureappharborstripe-payments

What is Appharbors SSL SNI, and is it sufficient to run Stripe Payments?

I am wanting to build my first production application for a client using AppHarbor for the first time.

I am debating on windows azure vs. appharbor and I need the following features:

custom hostname SSL for payments MSSQL Database

The cheapest price wins! So far from what I have found I can set up Azure with 1 small VM, a 10 GB database, and a fair amount of bandwidth for about $130.

Looking at AppHarbor I could go with the Catarman plan for $49 and add a shared SQL Server instance for $10 (10GB).

The only thing I don't understand is what SSL SNI is, and whether or not it is sufficient for mobile payments.

Has anyone set up a production app running on Appharbor with asp.net and mssql? Anything I need to be aware of. I am used to the Azure hosting environment, but I believe it could be less expensive trying app harbor. Let me know if there are any roadblocks with AppHarbor that I may be missing, as well as what the implications are with SSL SNI.

Thank you!

EDIT: Sorry, it is a little opinion based so let me see if i can break it out into some fact finding:

  1. Is there a downside to using SSL SNI when processing payments on my application? Less security? Less browser support?

  2. If you have set up an asp.net MVC application using EF code first with migrations, is there anything that is different with appharbor vs. windows azure?

This is the root of the question, but expert opinions are welcome (though I suppose frowned upon in this particular stack exchange site..)

Solution

  • Responses:

    1. SSL SNI allows multiple HTTPS websites to be served off the same IP address, meaning it is easier and cheaper for providers to run. The only downside is lack of support in older browsers; for example, it won't work on IE6, and it won't work with any version of IE on Windows XP. Also, it won't work on the default Android browser for versions 2.3 (GingerBread) and below. Wether or not this is an issue really depends on your target demographic. For example, stats suggest Windows XP is still widely used (at time of writing).
    2. I surmise that EF Code First Migrations would work in exactly the same way with AppHarbor as with Azure, as they both target a SQL Server Database using a standard connection string approach. Indeed, I've tried it out in both environments and haven't yet found a difference.

    A further point to consider with SSL is whether or not to use an 'Extended Validation Certificate', especially if you're considering commerce on your site. These require more extensive vetting of the requesting party before they are issued, meaning they are, in theory, more trusted. Most modern browsers indicate whether or not the site you are browsing has an EV Certificate by turning part of the UI green, such as the SSL Padlock. EV Certificates are more expensive and the vetting process can be quite arduous. You probably need some form of registered company entity, for example.