I guess I started this debate so perhaps we can widen it my making it
more general and hopefully come up with a general solution...
The issue is the following: Suppose I have a site which receives and
transmits sensitive user data. Obviously, I want to protect it with SSL.
However, 90% of the content of the site is GIF which doesn't really need
to be encrypted (logos, navigation-bars etc.) Now, if the whole
DocumentRoot is under SSL, these rather large, GIF files will be
laboriously encrypted and decrypted in the course of the transfer even
though they contain unconfidential information (it's just the same GIF
that's on my unsecured home-page!).
Question 1: Should we worry about this at all? (my manager was worried
about the load and so felt that we should).
My solution to (1) was to use mod_rewrite [see footnote] to serve the
pages from a plain HTTP VH. However, as James Treworgy points out, this
leads to all sorts of unfriendly warnings in the browser.
Question 2: Is anyone aware of a general solution for this "problem" -
i.e. how to serve selected components of an SSL page via plain HTTP.
Best regards,
owen Boyle.
[footnote: Our site is developed on an internal server and mirrored to
an external server and so we cannot use explicit links to GIFs (e.g.
src="http://..etc) while on the internal server.]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
