I was wondering if anyone has any experience with creating a mapped domain within GCP's Cloud Run with on a domain that is managed by Cloudflare.
When I do so, I end up getting a 525 (SSL Handshake Failed). With limited visibility as to what is happening on GCP's side, I can't really debug what the issue is.
Any tips or pointers would be greatly appreciated 🙏
Found my answer here, turns our Cloudflare isn't currently supported by CloudRun: https://github.com/ahmetb/cloud-run-faq#how-can-i-configure-cdn-for-cloud-run-services
so I have a cookiecutter Django app on deployed on Heroku. Now I want to use cloudlfare to connect my custom domain to it. I set up the cloudflare cname records accordingly like explained here: https://support.cloudflare.com/hc/en-us/articles/205893698-Configure-Cloudflare-and-Heroku-over-HTTPS
So both my cnames (one of my website name and one of called www) are both pointing at my DNS target that I got from Heroku when I added my domain.
Now what I get is an 525 ssl Handshake Error.
My question now is the following: I know that cookiecutter django forces ssl. Could that be the problem? Or could it be that I need to activate ssl on my hosting domain? (The problem with that is that my hoster tells me I can't get a ssl certificate when using another namespace, which I do, since I use cloudflare.)
Or what else could be the problem... I am a bit out of options....
Thanks in advance for your help....
I have a digitalocean One-Click Ubuntu Wordpress Droplet with a NameCheap domain.
I've never done anything with SSL before so I followed a tutorial (https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04). Once I made it to the end with no issues, I realized that it was a self-signed certificate and didn't remove the warning that browsers were giving and that I had to purchase one from a provider. Since my domain is through NameCheap, I went through them (Comodo?) and followed their linked tutorial for the setup (https://brettdewoody.com/how-to-setup-ssl-certs-with-digitalocean-and-comodo/).
I made it through that and browsers were bringing up an error saying that it was a self-signed certificate and it could be a problem. I went back through both tutorials and checked my stuff and tried to remove what I could of the original part. After blindly finagling things for a few hours, my site receives an A+ from this ssl checker (https://www.ssllabs.com/ssltest/analyze.html?d=vc2online.com) but browsers refuse to connect to the site (vc2online.com).
I don't even know where I need to start to get this to working properly.
Currently your issue is that you have 301 redirect from vc2online.com to www.vc2online.com but unfortunately your ssl certificate is only for vc2online.com, not www.vc2online.com.
You enabled HSTS so going backward won't be easy.
The quickest way to solve it is by using let's encrypt instead the comodo certificate.
You can use certbot to fully automate the process. You will find out it is much easier (and cheaper) than comodo paid certificate
P.S. I think this question should be asked in super user / server fault.
I would like to set some SSL certificates for one app I have on heroku (a simple application based on nodeJS + Vue).
I know if I upgrade to the Hobby Plan (7$ for month) I can have it automatically.
But for now it would too much money for a test application, so I am wondering if I can achieve some similar goal also with a Free Plan.
so:
Is it possible to set SSL certificate for an app on Heroku JUST with the Free Plan?
Maybe in a complicated/tricky way via CLI?
From the Heroku pages and documentation it looks not possible.
But I have to ask :)
Here I have a better approach to deal with this. As Heroku Doesn't provide SSL for Free Plan.
But You can use Cloudflare which gives free SSL.
You can Use Cloudflare As Bridge For SSL.
Requirement:
Cloudflare Account
Your Application should not have inbuild SSL redirection (like redirect-ssl)
Otherwise, This will result in Too Many Redirect Error
Step 1: Point Your domain to CloudFlare. You basically open an account an enter your domain when prompted. You may be given instructions to change your domain name servers.
Step 2: Add Cname Record of Heroku Server in DNS of Cloudflare. Instructions are here
Here You will get Some SSL Security Issue.
Step 3: Now Change Your SSL/TLS encryption mode to Flexible (Not Full). *Important
Now Understand the Working:-
Client(Browser) Make Request to https://example.com
First, the request reaches the Cloudflare with SSL. (User see encrypted connection to the server.)
Then Cloudflare makes request to Heroku Server(Origin) with Non-SSL (Non-Https and Unencrypted).
Then Heroku Server (Origin) returns the Response with Non-SSL to Cloudflare.
At the end Cloudflare forward the request to Client (Browser.)
You might think, What is the benefit of just encrypting half system.
but "Something is better then nothing".
You are here because you don't want to spent money on heroku paid dynos.
This method is better for those who is using http. Atleast it protects the most vulnerable side (client side). Where most of the attack happen. There is very less chances of attack between cloudflare and your server. Because of network reach.
Having less vulnerable probability is better then 100% vulnerable system
I have tested this method and working on https://www.auedbaki.com
Late response but I'm adding here I just spent an hour trying to setup SSL with Heroku - resulting in a dead end.
The bottom line is that Heroku mentions they offer free SSL certificates but that's really not the case unless you have a Hobby ($7/mo) or Pro plan.
This link has more details and feedback from other users facing the same issue.
The answer above about LetsEncrypt is incorrect. Although you can get a free certificate, it cannot be included in a free Heroku app.
Other users have pointed to this article with a step-by-step guide but the guide is outdated and the 'Labs' option mentioned does not work with Heroku anymore.
see comments below for some alternative suggestions
In my specific case, I was able to get a free SSL on zeit.
Here's how you get FULL SSL using Cloudflare for FREE.
Step 1: Point Your domain to CloudFlare. You basically open an account an enter your domain when prompted. You may be given instructions to change your domain name servers.
Step 2: Add Cname Record of Heroku Server in DNS of Cloudflare. Instructions are here. Here You will get Some SSL Security Issue.
Step 3: Now Change Your SSL/TLS encryption mode to Full
Step 4: In your DNS settings, you’ll want to create a CNAME: yourdomain.com -> yourapp.herokuapp.com.
(I learned about the general approach here https://mikecoutermarsh.com/adding-ssl-to-heroku-with-cloudflare/ Although it's old, it still works.
I had this issue also. I wanted to set up a custom domain for my free account on Heroku for my React App. I searched so much info on the web and read loads of documents from Heroku support.
The conclusion is that on the Heroku free account, a custom domain name with SSL certificate cannot be setup. If you need SSL with your custom domain name, you need to upgrade to any of their paid hosting accounts.
Heroku does provide SSL certificate for their free account as long as it is not using a custom domain name. So the standard free account URL will be something like this "https://your-app-name.herokuapp.com"
NB. Google Firebase allows free hosting and Custom Domain name with SSL, for up to a certain amount of traffic before charging. For testing an app, this will be a perfect alternative. I am using it. And it was easy to set up my custom domain.
I hope this saves you hours of searching.
Since you don't make explicit if you need to apply the SSL certificate to a custom domain, I think it's necessary to say that according to the Heroku documentation:
Apps using free dynos can use the *.herokuapp.com certificate if they
need SSL.
https://devcenter.heroku.com/articles/ssl
Maybe future readers could find this answer helpful...
If you are using
1]free heroku,
You can't use 1)free ssl or 2)paid ssl
2]paid heroku
1)you get free ssl 2)you can use paid ssl also
Solution
1]get paid heroku
2]move to netlify or other alternatives
Free SSL in Heroku doesn't exist, or let me just say that it's impossible to achieve it on a free plan.
For you to be able to include any form of third party SSL in Heroku, be it paid SSL or Free Third Party SSL, you have to change to Hobby or Professional dynos for the SSL to work.
An easier option, if you're using Heroku, there's no need to buy a third party SSL. Just change to Hobby or Professional dynos.
For you to be able to change the dyno type, select your app, go to sources section on the upper part, just bellow it, click on the Change Dyno Type button.
Hobby Dyno will cost you $7 a month while Professional Dyno will cost you $25 - $500 a month.
After all that, remember to go to your Rails App:
Go to; .../config/environments/production.rb
--> Uncomment the following line:
# config.force_ssl = true
---> To:
config.force_ssl = true
After that, you'll be able to achieve your SSL but not FREE.
If you don't mind hosting your frontend on another service you can host it in Vercel, with free SSL, while you keep your backend at Heroku. Quite straightforward!
https://vercel.com/
One way around this could be setting up a proxy server on a host you can set SSL certificates on and then simply forward requests to the free herokudns domain using encryption as well.
You'd have to have a separate server with something like nginx or httpd running.. I am not sure of a free service to host the proxy, but usually when you sign up for a domain you may get a hosting addon with it, or perhaps people already have acess to an encrypted host and just want to also use Heroku for their node applications.
Setting up a httpd proxy would look somewhat like this (from https://serverfault.com/questions/84821/apache-proxypass-with-ssl):
<VirtualHost 1.2.3.4:80>
ServerName customdomain.com
SSLProxyEngine On
SSLProxyCheckPeerCN on
SSLProxyCheckPeerExpire on
ProxyPass / https://heroku-app-name.herokuapp.com
ProxyPassReverse / https://heroku-app-name.herokuapp.com
</VirtualHost>
This way you have full encryption all the way :)
This is a question rather than an answer, actually. Has anyone tried ZeroSSL? It offers free SSL, and here is an installation guide for Heroku. However, SSL Endpoint is apparently deprecated and not recommended by Heroku, and it appears to be paid addon of Heroku.
$ cat example.crt ca_bundle.crt certificate.crt
I could not make sense of this line in the help. Perhaps, > is missing? Where does example.crt come from, when I only have the following files?
certificate.crt
ca_bundle.crt
private.key
Or can Heroku SSL accept SSL certificates issued from ZeroSSL?
I'm facing a pain in the ass described as follow:
My iOS app is defined to connect to our company's server, which is a HTTPS one that satisfies all the requirements needed by iOS9's App Transport Security Policy
The app works well with most users
But sometimes there's some users/devices cannot connect due to a -1022 error saying that ATS has rejected our HTTPS server as it's a cleartext server (?!)
After deleting then reinstalling exactly the same build, those users/devices can connect to our server seamlessly
So is there anyone ever encountered the same problem? Can anyone please help troubleshoot the issue?
Note: I strongly against adding my domain the the plist nor using nsallowsarbitraryloads because our server's ssl certificate is strictly valid and satisfy the requirements.
Thanks a lot!
I can think of two scenarios where this could happen:
Your App is trying to access some specific page or link over HTTP (even tho the server supports HTTPS); you could perhaps search for http:// URLs within your code.
There is a specific page or URL on the server that is redirecting clients (such as your App) to HTTP, from HTTPS.