I am having a domain chansek.com, hosted in Openshift through a Wordpress application. But the problem is, when I am trying to open my Wordpress Admin, it's always trying to connect through https instead of http. As I don't have any SSL certificate, it gives me some warning message. Please see the below screenshot for better understanding.
How do I make it go through http? I don't want any SSL certificate for my website as it's a personal blog.
I am also trying to use JetPack plugin. But it gives following error.
Your website needs to be publicly accessible to use Jetpack: site_inaccessible Error
Details: The Jetpack server was unable to communicate with your site
https://www.chansek.com [IXR -32300: transport error: http_request_failed SSL:
no alternative certificate subject name matches target host name 'www.chansek.com']
You have a couple of options:
1.) Disable using SSL for the admin in your wp-config.php file. (Openshift redirects wp-admin to https)
2.) Upgrade to the bronze plan and the purchase a custom ssl certificate and install it
You are getting that error from jetpack because the ssl certificate is not valid for your custom domain, only for your app-domain.rhcloud.com address.
Related
I recently bought a domain name at OVH for an app I hosted on Heroku. I then paid for the dynos in order to set an automatic SSL certificate.
Everything seems to me working fine:
Domain Status Last Updated
─────────── ─────────── ────────────
mpjrigot.eu Cert issued 2 minutes
mpjrigot.fr Cert issued 2 minutes
But my URL is still in HTTP. What am I missing?
EDIT
I'm using React.js for this app
I also have a Ruby on Rails back but for nom i'm keeping that on the heroku.app, works fine
2nd EDIT
Using react-https-redirect, force-https or react-ssl-redirect...
Basically, chrome tells me that "this is not a safe space", and that this is a fake https that might want to steal the user's passwords and stuff
So I got an SSL that is set on my HerokuApp,
I got a domain on OVH that points to the IP of the app
But the http isn't secure somehow
I really think I missed something obvious as I'm new to this...
You can add HTTPS to your app with the following methods.
Method1 (Recommended)
Since, you're using rails for the backend, you can configure your rails app to always use HTTPS.
in your production.rb add
config.force_ssl = true
More Info: https://help.heroku.com/J2R1S4T8/can-heroku-force-an-application-to-use-ssl-tls
ActionDispatch SSL: https://api.rubyonrails.org/v6.1.4/classes/ActionDispatch/SSL.html
Method2 (Easy Setup)
You can also signup for cloudflare's free plan and easily setup https redirects with cloudflare's 'Always Use HTTPS' or 'Automatic HTTPS Rewrites' feature.
The 'Always Use HTTPS' feature will redirect all http requests on your site to https address.
The 'Automatic HTTP Rewrites' feature will change the HTTP links on your site to HTTPS links.
More Info here:
Always use HTTPS: https://blog.cloudflare.com/how-to-make-your-site-https-only
Automatic HTTPS: https://www.cloudflare.com/website-optimization/automatic-https-rewrite/
Cloudflare's SSL: https://www.cloudflare.com/ssl/
cloudflare dashboard
What am I missing?
Heroku provides a certificate, so you should be able to access your application using https://. However it does not redirect HTTP requests to HTTPS for you:
Redirects need to be performed at the application level as the Heroku router does not provide this functionality. You should code the redirect logic into your application.
Exactly how you do that depends on the language and libraries or framework that you are using. Several common examples are listed in the link I provided above.
If you edit your question to tell us what technology you have used to build your application I'll be happy to add those details to this answer. In case you are using Scala, please see How to disable HTTP requests on Heroku and/or auto-redirect to HTTPS?
solution
I eventually read about Heroku needing a specific host that takes in the address they tell you to point to when setting a domain name...
So I switched to Gandi for my domain name and set the ALIAS to point to said adress
Works like a charm
I have one nodejs web app on ibm cloud: MYAPP.eu-de.mybluemix.net.
I want it to be reachable over https on https://MYSUB.MYDOMAIN.IO
I own MYDOMAIN.IO, and added this CNAME entry in my dns provider: MYSUB.MYDOMAIN.IO. 0 CNAME MYAPP.eu-de.mybluemix.net.
I purchased a certificate for SUB.MYDOMAIN.IO added the domain in my organisation, and uploaded the certificate. Note it is not a wildcard. I read that long ago bluemix only accepted wildcards, but I could upload my single certificate without issue.
I also added the route to the app so I have 2 routes in the settings, both with the padlock green:
MYAPP.eu-de.mybluemix.net
MYSUB.MYDOMAIN.IO
After all this, when I navigate to https://SUB.MYDOMAIN.IO, I end up on the app page (redirection working), BUT I get the security warning because the certificate is still the one of bluemix, not mine.
What am I doing wrong???
ok got it sorted after swimming in an ocean of outdated ibm doc, I found that to use custom domain, the DNS config should be a CNAME to a specific domain name.
in my case, not MYAPP.eu-de.mybluemix.net but MYAPP.eu-de.cf.appdomain.cloud
This URL was always there in the list of available domain, but it was hard to find its use.
https://cloud.ibm.com/docs/apps?topic=creating-apps-ssl_csr#ssl_csr?cm_mmc=TonyErwin--Data--WW_WW-_-SSLCerts
The problem:
I have 2 websites that have the same IP address (a domain and a subdomain), and I have an SSL certificate for each of them. The domain is a word-press site while the sub domain is a ruby on rails application. the subdomain has the certificate installed and works with no problems, but when I try to add the second certificate for the main domain, it works, but it prevents access to the subdomain.
In the web browser inspection page it shows this error :
“XMLHttpRequest cannot load https://giladparking.com/wp-content/plugins/wp-slimstat/wp-slimstat-js.php. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://monthly.giladparking.com' is therefore not allowed access.”
What I have tried:
I have followed this tutorial to allow for SNI support and it seems to work except for the previously mentioned issue.
I have taken a look at this post as well which explains that you can't make XMLHTTPRequests across domains. but this issue only arises when both certificates are in effect.
“XMLHttpRequest cannot load https://giladparking.com/wp-content/plugins/wp-slimstat/wp-slimstat-js.php....
The certificate for this sites is valid for monthly.giladparking.com and www.monthly.giladparking.com but not for giladparking.com. That's why any access to this site will fail with a certificate error. This problem is not restricted to XMLHTTPRequests.
Any ideas why I might be getting the "No Such App" error when I go to my herokussl.com URL (after adding a cert and Heroku SSL endpoint)?
I followed the instructions here (https://devcenter.heroku.com/articles/ssl-endpoint), and got a herokussl.com URL.
I really don't think it's a DNS issue - as I haven't even gotten to that step.
It appears you can't access sites directly through the herokussl.com - which kinda makes sense, since they already provide wildcard ssl on herokuapp.com. I've just tried this with a production site I have which uses SSL and get the same "No Such App" if i access the herokussl.com domain directly.
If you CNAME your custom domain to the herokussl.com domain that were provided or from heroku certs and make sure you've added the custom domain to your application via heroku domains:add <customdomain> then it works fine.
I was under the impression that if a user attempted to visit a website that had been secured with an SSL certificate, but did not use HTTPS and instead used plain HTTP in the address box, a 403;4 error would be generated, and that an errormessage something like this would be presented:
"This page must be viewed over a secure channel"
"The page you are trying to access is secured with Secure Sockets Layer (SSL)."
But that's not happening on our website. You can use http://secure.oursite.com or https://secure.oursite.com and both work fine.
The company that issued the SSL certificate says our certificate checks out OK in their certificate checking tool and that it's "chaining properly" and that this is an IIS configuration issue.
Does this SSL over HTTP error checking have to be explicitly enabled?
I was planning on creating a custom error for the 403;4 condition, pointing to a file, which redirects to https://secure.oursite.com. But the error condition is not being trapped by IIS.
EDIT: I've stopped and restarted the server. Not solved.
Thanks
As per this article have you checked the "Require secure channel (SSL)" box in the properties for your site? This is what triggers the error. You can then create the redirect using a custom error page.
a 403;4 error would be generated
That's not what happens in my site. My site automatically redirects to the HTTPS port. It's done free of charge by Tomcat.