You pay $600 per month for each custom SSL certificate associated with one
or more CloudFront distributions. This monthly fee is pro-rated by the hour.
For example, if you had your custom SSL certificate associated with at least
one CloudFront distribution for just 24 hours (i.e. 1 day) in the month of June,
your total charge for using the custom SSL certificate feature in June will be
(1 day / 30 days) * $600 = $20.This is... impressively expensive.
ps: check out the insane pricing for dedicated certs & https on some other CDNs. $600/mo doesnt look too excessive in comparison.
Not least because they intend to give SSL to everyone (even the free tier) very soon, and have acquired enough IPv4 addresses to make doing so possible. Additionally their price for custom SSL certificates is a fraction of the price of CloudFront.
It is strange, watching a company like Amazon make a pricing decision like this, knowing how it will then shift things.
In our startup ( http://microco.sm ), we are implementing S3 for storage, and then to use multiple reverse proxies that make our static files surface (with our sites) through CloudFlare. The best of both worlds.
When a group of U.S. ISPs first started working on anti-phishing solutions, we realized that the problem with SSL is that apparently nobody told users they needed to check anything but the golden lock icon to verify security. "Oh, look, I have a secure connection to bankofamerica.b1llingprovider.com, seems legit".
That being said, I'm hoping they'll switch to SNI at some point. Windows XP won't be around forever (well, one can hope...). IMHO SNI is the better long-term solution (especially when it comes to costs), so once the number of clients not supporting SNI drops to a negligible number, they should go for it.
I presume it means that when I upload an SSL cert and associate it with one (or more) cloudfront distribution, that Amazon ends up dedicating at least one IP address at every edge location solely to my SSL cert?
I guess the scarcity of IP address space explains the steep pricing? They want you to consider other options before asking to reserve 40 dedicated IP addresses.
Hopefully they'll be able to switch to Server Name Indication (SNI) in the near future as that would save a lot of IP addresses (and, if that's their biggest cost factor, allow them to lower the price). I think Windows XP is the biggest obstacle w.r.t. SNI, but thankfully XP will be EOL'd soon(ish).
With regards to the security hole, do you mean to say that having the domain name sent in the clear before the secure session is established is the problem? Other than some narrow privacy concerns, I can't see the real issue here, given that most of the time a certain IP address implies a certain domain name, and the destination IP address needs to be sent in the clear.