I have a digitalocean One-Click Ubuntu Wordpress Droplet with a NameCheap domain.
I've never done anything with SSL before so I followed a tutorial (https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04). Once I made it to the end with no issues, I realized that it was a self-signed certificate and didn't remove the warning that browsers were giving and that I had to purchase one from a provider. Since my domain is through NameCheap, I went through them (Comodo?) and followed their linked tutorial for the setup (https://brettdewoody.com/how-to-setup-ssl-certs-with-digitalocean-and-comodo/).
I made it through that and browsers were bringing up an error saying that it was a self-signed certificate and it could be a problem. I went back through both tutorials and checked my stuff and tried to remove what I could of the original part. After blindly finagling things for a few hours, my site receives an A+ from this ssl checker (https://www.ssllabs.com/ssltest/analyze.html?d=vc2online.com) but browsers refuse to connect to the site (vc2online.com).
I don't even know where I need to start to get this to working properly.
Currently your issue is that you have 301 redirect from vc2online.com to www.vc2online.com but unfortunately your ssl certificate is only for vc2online.com, not www.vc2online.com.
You enabled HSTS so going backward won't be easy.
The quickest way to solve it is by using let's encrypt instead the comodo certificate.
You can use certbot to fully automate the process. You will find out it is much easier (and cheaper) than comodo paid certificate
P.S. I think this question should be asked in super user / server fault.
Related
I would like to set some SSL certificates for one app I have on heroku (a simple application based on nodeJS + Vue).
I know if I upgrade to the Hobby Plan (7$ for month) I can have it automatically.
But for now it would too much money for a test application, so I am wondering if I can achieve some similar goal also with a Free Plan.
so:
Is it possible to set SSL certificate for an app on Heroku JUST with the Free Plan?
Maybe in a complicated/tricky way via CLI?
From the Heroku pages and documentation it looks not possible.
But I have to ask :)
Here I have a better approach to deal with this. As Heroku Doesn't provide SSL for Free Plan.
But You can use Cloudflare which gives free SSL.
You can Use Cloudflare As Bridge For SSL.
Requirement:
Cloudflare Account
Your Application should not have inbuild SSL redirection (like redirect-ssl)
Otherwise, This will result in Too Many Redirect Error
Step 1: Point Your domain to CloudFlare. You basically open an account an enter your domain when prompted. You may be given instructions to change your domain name servers.
Step 2: Add Cname Record of Heroku Server in DNS of Cloudflare. Instructions are here
Here You will get Some SSL Security Issue.
Step 3: Now Change Your SSL/TLS encryption mode to Flexible (Not Full). *Important
Now Understand the Working:-
Client(Browser) Make Request to https://example.com
First, the request reaches the Cloudflare with SSL. (User see encrypted connection to the server.)
Then Cloudflare makes request to Heroku Server(Origin) with Non-SSL (Non-Https and Unencrypted).
Then Heroku Server (Origin) returns the Response with Non-SSL to Cloudflare.
At the end Cloudflare forward the request to Client (Browser.)
You might think, What is the benefit of just encrypting half system.
but "Something is better then nothing".
You are here because you don't want to spent money on heroku paid dynos.
This method is better for those who is using http. Atleast it protects the most vulnerable side (client side). Where most of the attack happen. There is very less chances of attack between cloudflare and your server. Because of network reach.
Having less vulnerable probability is better then 100% vulnerable system
I have tested this method and working on https://www.auedbaki.com
Late response but I'm adding here I just spent an hour trying to setup SSL with Heroku - resulting in a dead end.
The bottom line is that Heroku mentions they offer free SSL certificates but that's really not the case unless you have a Hobby ($7/mo) or Pro plan.
This link has more details and feedback from other users facing the same issue.
The answer above about LetsEncrypt is incorrect. Although you can get a free certificate, it cannot be included in a free Heroku app.
Other users have pointed to this article with a step-by-step guide but the guide is outdated and the 'Labs' option mentioned does not work with Heroku anymore.
see comments below for some alternative suggestions
In my specific case, I was able to get a free SSL on zeit.
Here's how you get FULL SSL using Cloudflare for FREE.
Step 1: Point Your domain to CloudFlare. You basically open an account an enter your domain when prompted. You may be given instructions to change your domain name servers.
Step 2: Add Cname Record of Heroku Server in DNS of Cloudflare. Instructions are here. Here You will get Some SSL Security Issue.
Step 3: Now Change Your SSL/TLS encryption mode to Full
Step 4: In your DNS settings, you’ll want to create a CNAME: yourdomain.com -> yourapp.herokuapp.com.
(I learned about the general approach here https://mikecoutermarsh.com/adding-ssl-to-heroku-with-cloudflare/ Although it's old, it still works.
I had this issue also. I wanted to set up a custom domain for my free account on Heroku for my React App. I searched so much info on the web and read loads of documents from Heroku support.
The conclusion is that on the Heroku free account, a custom domain name with SSL certificate cannot be setup. If you need SSL with your custom domain name, you need to upgrade to any of their paid hosting accounts.
Heroku does provide SSL certificate for their free account as long as it is not using a custom domain name. So the standard free account URL will be something like this "https://your-app-name.herokuapp.com"
NB. Google Firebase allows free hosting and Custom Domain name with SSL, for up to a certain amount of traffic before charging. For testing an app, this will be a perfect alternative. I am using it. And it was easy to set up my custom domain.
I hope this saves you hours of searching.
Since you don't make explicit if you need to apply the SSL certificate to a custom domain, I think it's necessary to say that according to the Heroku documentation:
Apps using free dynos can use the *.herokuapp.com certificate if they
need SSL.
https://devcenter.heroku.com/articles/ssl
Maybe future readers could find this answer helpful...
If you are using
1]free heroku,
You can't use 1)free ssl or 2)paid ssl
2]paid heroku
1)you get free ssl 2)you can use paid ssl also
Solution
1]get paid heroku
2]move to netlify or other alternatives
Free SSL in Heroku doesn't exist, or let me just say that it's impossible to achieve it on a free plan.
For you to be able to include any form of third party SSL in Heroku, be it paid SSL or Free Third Party SSL, you have to change to Hobby or Professional dynos for the SSL to work.
An easier option, if you're using Heroku, there's no need to buy a third party SSL. Just change to Hobby or Professional dynos.
For you to be able to change the dyno type, select your app, go to sources section on the upper part, just bellow it, click on the Change Dyno Type button.
Hobby Dyno will cost you $7 a month while Professional Dyno will cost you $25 - $500 a month.
After all that, remember to go to your Rails App:
Go to; .../config/environments/production.rb
--> Uncomment the following line:
# config.force_ssl = true
---> To:
config.force_ssl = true
After that, you'll be able to achieve your SSL but not FREE.
If you don't mind hosting your frontend on another service you can host it in Vercel, with free SSL, while you keep your backend at Heroku. Quite straightforward!
https://vercel.com/
One way around this could be setting up a proxy server on a host you can set SSL certificates on and then simply forward requests to the free herokudns domain using encryption as well.
You'd have to have a separate server with something like nginx or httpd running.. I am not sure of a free service to host the proxy, but usually when you sign up for a domain you may get a hosting addon with it, or perhaps people already have acess to an encrypted host and just want to also use Heroku for their node applications.
Setting up a httpd proxy would look somewhat like this (from https://serverfault.com/questions/84821/apache-proxypass-with-ssl):
<VirtualHost 1.2.3.4:80>
ServerName customdomain.com
SSLProxyEngine On
SSLProxyCheckPeerCN on
SSLProxyCheckPeerExpire on
ProxyPass / https://heroku-app-name.herokuapp.com
ProxyPassReverse / https://heroku-app-name.herokuapp.com
</VirtualHost>
This way you have full encryption all the way :)
This is a question rather than an answer, actually. Has anyone tried ZeroSSL? It offers free SSL, and here is an installation guide for Heroku. However, SSL Endpoint is apparently deprecated and not recommended by Heroku, and it appears to be paid addon of Heroku.
$ cat example.crt ca_bundle.crt certificate.crt
I could not make sense of this line in the help. Perhaps, > is missing? Where does example.crt come from, when I only have the following files?
certificate.crt
ca_bundle.crt
private.key
Or can Heroku SSL accept SSL certificates issued from ZeroSSL?
My ssl certificate has expired and I have created a new one using Startssl. I have followed the steps for Nginx server that I have found in the FAQs from Startssl but, although the paths to the certificate and the key are correct, when I try to load the website with any browser it always gets the old certificate instead of the new one. Do anyone knows what can be happening?
Thanks!
March 22th UPDATE:
I have found something of what is happening: we have 2 web servers in AWS and a Load balancer. I have seen the load balancer has also the ssl certificate and I guess I have to update it too. I have done it and now the new certificate is in usage. But I still see an error: the server cannot check my domain because my certificate comes from one of my subdomains. When I created the certificate in StartSSL there was an step that asks me for a subdomain. It said the certificate will be for the domain and subdomain, but now I'm getting this message. Any idea?
I have found the answer:
When StartSSL asked for a subdomain when I was following the steps to get the new certificate, I was indicating one of my real subdomains. If I set as subdomain "www" everything works. So I wanted to share my experience with everyone hoping it helps:
First: when you are asked for a subdomain in StartSSL, set it as "www".
Second: If you are using AWS and you have a load balancer, don't forget to update the SSL certificate in the load balancer, using the AWS NETWORK & SECURITY -> Load balancers option (Listeners tab).
Hope it helps.
Thanks for reading and trying to help me.
I recently bought the SSL certification off GoDaddy in India for my domain anrweb.com
The only problem is that the https:// version throws up an "SSL connection error" on Chrome & Firefox. I had incorporated a web.config file that redirects all http requests to https, but that caused the website to not load at all!!
I'm weak in these server-side setups and was looking for help online but was unable to find any resources. Godaddy has no clue whats happening either.
Can someone tell me if I need to make any other changes to my DNS records or any other back-end updates to reflect the SSL installation.
BTW, my domain services, hosting & SSL are all from GoDaddy
What version of Firefox and Chrome are you using? I'm able to access the site on Chrome 40.0.2214.91. The SSL Labs test https://www.ssllabs.com/ssltest/analyze.html?d=anrweb.com does not indicate any handshake errors although your choice and ordering of cipher suites could use some cleanup. https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html has the recommended SSLCipherSuite value.
Solved.. Turns out I had to point my DNS to the newly issued static, permanent IP address. Works just fine now.
GoDaddy should've mentioned this during the setup, but figured it out anyway.
Thanks a ton
I've been getting reports of users visiting our site getting "this certificate is not trusted" errors when visiting our site via https. I don't seem to ever have any problems, but two separate people on my team have gotten this error randomly when they're on a different wifi network other than the one at our office. They don't have the same problem at the office.
I read up on intermediate certificates but this seems to be just a browser thing, not a network related issue.
I have an SSL cert from GoDaddy, it's on a Rails app running on nginx + unicorn.
Does anyone have any other ideas why this might happen? I'm pretty stumped.
Be sure that everyone is using the same host name.
I've seen this issue if there are multiple server aliases, for example www.foo.com and foo.com. be sure the one without the SSL certificate is redirecting traffic.
From home someone was using a different hostname, because of browser history. Fixing up the redirects fixed the problem.
The error should be tied to your browser not trusting the intermediate cert and not related to wifi. Please make sure the browser trusts the intermediate and root ca trust of GoDaddy.
Here's a possible scenario.
Let's say I have a website "https://www.mywebsite.com" and there is a valid SSL certificate purchased for this domain.
I want to "mimick" this website on my LOCAL machine for a testing purpose.
So let's say I set up a locally-configured "https://www.mywebsite.com" (which is in essence https://localhost/mywebsite or something similar).
Would I be able to re-use the SSL certificate on my local testing website?
You can re-use your SSL certificate if you configure your DNS so that your test machine is the same domain name as server, which is probably a bad idea.
You can also re-use it on your test machine if you don't mind clicking the box "accept this whacked out ssl cert"... So I suppose that the answer is technically yes, although I wouldn't personally do it.
It depends what you are trying to test and why you need a certificate for testing.
If you use the certificate, it will correctly encrypt connections using SSL, but any client will get a certificate mis-match error. If you use a self-signed certificate instead, most clients will give you a warning about that, so it might be just as annoying or not.
If you are testing, for instance, a deployment script to make sure everything gets installed in the right place, it will work. If you are testing to make sure your code correctly redirects a non-secure connection to a secure one, it will work.
If you want to test the your website for functionality, usability, bugs, etc. then your testers will likely complain about the certificate warnings or errors, and you're probably better off doing something else.
I am not sure since the SSL certificate is bound by the domain name that was registered with the certificate. But you may be able to dupe the certificate by editing your hosts file to change localhost 127.0.0.1 to be mysite.com 127.0.0.1, ...in theory at least...if not this is a question for serverfault.com.
Hope this helps,
Best regards,
Tom.
You can't use it since the SSL cert is tied to the domain www.mywebsite.com unless you do a bit of trickery.
You can put an entry in your hosts file saying that domain is at 127.0.0.1, but that's not ideal as you could no longer reach the website.
If you just need a valid cert to test with, then a better alternative is to self-sign using the IIS Resource Kit.
I'm no expert on DNS, but this would introduce a pretty major vulnerability.
Basically if this was allowed, DNS poisoning could be used defeat the whole purpose of third party trust.
Think about it:
I infect your computer so that when you go to www.amazon.com it resolves www.amazon.com to a different domain. That domain uses amazon's ssl cert to fool you into thinking it's legit, so you send me your credit card information.
So, the answer to your question is, no you can't do this. You will still get errors, My guess is that somewhere on the verfication chain, it compares the domain that initiated the request with what its internal dns resolves the domain, to verify there is a match.
As others have said, you can test SSL with a Self Signed Cert, you just have to instruct your testers to import the cert, or go through the trouble of building your own trusted CA, and have testers add that CA as a trusted CA.
There is no point in stealing another sites SSL Cert.
Of course you could use the vulnerability in MD5 to create your own valid SSL cert.
http://www.digicert.com/news/2009-01-05-md5-ssl.htm