Recently, I've begun trying to deploy my Heroku app to my domain name. I've added SSL Endpoint, bought a cert, configure the cert, and changed the DNS. Yet I still get the warning You attempted to reach www.foo.com but instead reaching a server identified as *.herokuapp.com
I've read the SSL Endpoint documentation, DNSimple's documentation, but nothing seems to fix this.
Here's what is returned from the usual perpetrators:
$ heroku certs
Endpoint Common Name(s) Expires Trusted
---------------------- ---------------------- -------------------- -------
SSL_NAME.herokussl.com www.foo.com, foo.com 2014-09-17 04:29 UTC True
$ heroku domains
=== foo Domain Names
www.foo.com
foo.com
foo.herokuapp.com
And the DNS records (via DNSimple):
CNAME www.foo.com SSL_NAME.herokussl.com
ALIAS foo.com SSL_NAME.herokussl.com
TXT foo.com ALIAS for SSL_NAME.herokussl.com
I've also tried just simply:
CNAME www.foo.com SSL_NAME.herokussl.com
URL foo.com https://www.foo.com
Am I missing something here? I have waited multiple days for the DNS changes to go into effect, yet this is still occurring. If any other information would help, just let me know! Thanks!
Turns out that I forgot that I had the Zerigo DNS add-on installed which had a CNAME record pointed to proxy.herokuapp.com. I removed the add-on (since my DNS was configured elsewhere) and it works as it should!
Related
I am trying to get the SSL certification for my app with Heroku, but the Automated Certificate Management is failing for one of both domain names.
I created the dyno before March 2017, so I had to run heroku certs:auto:enable as explained here.
Then, heroku domains returns:
Domain Name DNS Record Type DNS Target
─────────────── ─────────────── ─────────────────────────────
example.com ALIAS or ANAME example.com.herokudns.com
www.example.com CNAME www.example.com.herokudns.com
This seems to be in line with what heroku expects.
Anyway, heroku certs:auto returns:
Domain Status
─────────────── ────────────
example.com Failing
www.example.com OK
I admit that I am quite illiterate for settings concerning domains, DNS and so on. Therefore, this might be a very simple mistake from my side. However, I read the Heroku troubleshooting documentation and also similar questions in SO such as a this one or this one and still have no clue what is wrong.
The fact that www.example.com is OK but example.com is failing just confuses me even more. And unfortunately, I received a notification email with no failure reason.
Namecheap
I guess the problem is either on Heroku or where I bought the domain. That is Namecheap.com.
There, at the Domain tab I have:
NAMESERVERS Namecheap BasicDNS
REDIRECT DOMAIN Source URL Destination
example.com http://www.example.com
And at the Advanced DNS tab:
Type Host Value TTL
------------- ----- ------------------------------- -------
CNAME Record www example.com.herokudns.com Automatic
TXT Record # google-site-verification... Automatic
URL Redirect Record # http://www.example.com/ Unmasked
What am I doing wrong?
Update
The issue seems to be due to Namecheap. I found the following ticket on Heroku:
Issue
User is having trouble pointing their root domain (aka apex
domain/naked domain) to their Heroku app, either with setting the
right DNS records, or accessing it over HTTPS.
Resolution
Root domains on Heroku require the use of "CNAME-like" records, often
referred to as ALIAS or ANAME records.
Unfortunately, a number of popular DNS hosts such as GoDaddy,
Namecheap, Bluehost, and others do not support these types of records.
Instead they tend to offer the following:
A records
URL redirects / forwarding
There are caveats with both of these options...
Surprisingly, I did not find any place where all the steps were explained clearly. What I did so far is:
Open an account with a DNS host that supports this. I took DNSimple. At the time of writing, prices start from 5€/month but there is a trial month for free.
Transfering the domain costs 14€/year, so I just pointed the name servers at Namecheap to DNSimple and added the domain to DNSimple to create the DNS records.
Then came the configuration on DNSimple. I followed the step 1 in the documentation to redirect HTTP to HTTPs; ignored the step 2, since Heroku's ACM had already done it; and for the step 3 the article Pointing the Domain Apex to Heroku was very helpful. I added manually an ALIAS record and I also added a CNAME record, like this:
Type Name Content
───── ─────────────── ───────────────────────
ALIAS example.commyapp.com.herokudns.com
CNAME www.example.commyapp.com.herokudns.com
At the beginning nothing was working and the browser showed the following error:
This site can’t be reached
www.example.com’s server IP address could not be found.
Checking the troubleshotting documentation I saw that the only possibility was the Name server propagation delay, so I waited. It felt like a very long time, but it actually took less than one hour until the site got online again.
However, the SSL certification keeps failing more than 48 hours later...
For future reference: after contacting Heroku support, they manually refreshed my certificate request and it was finally issued for my app...
Check the answer here especially the CloudFlare solution as it is free
Automated certificate management also provisions you a free SSL cert
from https everywhere. You don’t need to buy a cert.
However namecheap won’t work with ACM because they don’t allow an
“alias” record for your “apex” domain I.e. your domain with no
subdomain so https://example.com not https://www.example.com
Your options are switch to a dns registrar that supports an “alias”
record such as dnsimple. They charge $5 a month in addition to the
domain registration fee.
Or alternatively use a free cloudflare instance which comes with SSL.
If you already bought a cert there is a way to upload it to Heroku via
an SSL addon.
I use both DNSimple/Heroku ACM on some apps and cloudflare on some
others. Both are equally nice but cloudflare is free and gives you a
CDN too.
https://www.reddit.com/r/Heroku/comments/7wh5r4/setting_up_ssl_with_heroku_namecheap/
I am trying to get an SSL certificate on my custom domain on Heroku and the last thing it told me to do is add the following records:
Domain Record Type DNS Target
─────────────────── ─────────── ─────────────────────────────────
www.gethomesync.com CNAME www.gethomesync.com.herokudns.com
gethomesync.com ALIAS/ANAME gethomesync.com.herokudns.com
But my domain registrar GoDaddy doesn't have an option to add ALIAS or ANAME. I don't know much about DNS having only done quite basic tasks as and when I've needed them, is there an equivalent to ALIAS/ANAME that I can use through GoDaddy?
Thanks
A warning here. As pointed by #NikitaAvvakumov and #deviant in some comments, the accepted answer is not correct.
As mentioned in Heroku docs,
Root domains on Heroku require the use of "CNAME-like" records, often referred to as ALIAS or ANAME records.
Without these records,
Requests to https://example.com will fail with an SSL error.
Again, even if you choose to redirect from your root domain to a subdomain (ex: from example.com to www.example.com), it will only work for non-SSL requests. Any request to https://example.com will fail with an SSL error.
A simple solution to that would be to use another DNS host. For example, I use CloudFlare (the free plan is more than enough and offers great features) which uses what is called CName flattening that works with Heroku like having an ALIAS (they use this by default - you don't have to do anything else than configuring your nameservers and adding DNS records. You can check both Heroku and CloudFlare for tutorials - it's pretty easy).
You don't need to set up ALIAS/A record, just create a CNAME record pointing to gethomesync.herokussl.com (you can check the endpoint name with heroku certs Heroku Documentation):
Type Name Value
CNAME www gethomesync.com.herokudns.com
To create a naked domain (removes the need to write www) you need to forward your gethomesync.com to wwww.gethomesync.com:
Under Forwarding click on Domain -> 'Manage' -> then click 'Add Forwarding'
'Forward to' should be wwww.gethomesync.com (your domain)
'Redirect type' should be '301
'Forward settings' should be 'Forward only'
I get signals that people outside my country (nl) can not access my website. they say they see the Apache placeholder. It is just in some cases.
Is there something wrong with my dns?
m.skiweather.eu149.210.237.45A
skiweather.eu149.210.237.45A
mail.skiweather.eu149.210.237.45A
skiweather.eumail.skiweather.euMX (10)
smtp.skiweather.eu149.210.237.45A
pop.skiweather.eu149.210.237.45A
www.skiweather.eu149.210.237.45A
skiweather.eudns1.vpshosting.nlNS
skiweather.eudns2.vpshosting.nlNS
skiweather.eudns1.vpshosting.nl info#vpshosting.nl 2014081800 14400 3600 604800 3600SOA
skiweather.eudns3.vpshosting.nlNS
*.skiweather.eu149.210.237.45A
gfx.skiweather.eu149.210.237.45A
cdn.skiweather.eu149.210.237.45A
skiweather.eugoogle-site-verification=gtRAq2UWkOKRq1ITaaUuUhxqDh077OwH5aadHCX7TbcTXT
#.skiweather.euv=spf1 a mx ip4:149.210.237.45 include:_spf.google.com ~allSPF
skiweather.eu2a01:7c8:aabb:5e4:5054:ff:fe74:b8cdAAAA
Your DNS seems fine. Checking all your 3 nameservers return the same, correct, IP:
dig #dns1.vpshosting.nl skiweather.eu
dig #dns2.vpshosting.nl skiweather.eu
dig #dns3.vpshosting.nl skiweather.eu
In addition, https://intodns.com/skiweather.eu doesn't report any problems.
A problem though is that the https site (https://skiweather.eu/) returns:
Welcome to skiweather.eu
To change this page, upload a new index.html to your private_html folder
This is unrelated to DNS and regards configuration on your webserver which seems to be Apache httpd. So you'll have to check the <VirtualHost> block for port :443. You should make it look like the one for :80 (but do not remove the certificate related directives).
p.s your SSL certificate is self signed and not good. If you care to have proper https on your site have a look at https://letsencrypt.org/
I have my domain CNAME point to myapp-mynamespace.rhcloud.com however it throws this certificate error:
Doing rhc alias add proxy proxy.mynamespace.com would do the trick.
However, I just want to point arbitrary domain CNAME (like ww2 of xyz.com, abc.com or somedomain.com) to myapp-mynamespace.rhcloud.com
How do I get around this ssl issue, is it possible that when I point ww2 CNAME of xyz.com to my openshift app (myapp-mynamespace.rhcloud.com) it will not do https or ssl thing--just plain http.
You don't want a CNAME record, you want a web redirection, else the domain name will remain the one that points to rhcloud.com and the certificate will still be invalid for your web clients.
If you want to use SSL with your custom domain on OpenShift then you will need to upgrade to the Bronze or Silver plan and purchase an SSL certificate and install it for your alias.
I'm confused with this line in the Heroku docs (https://devcenter.heroku.com/articles/ssl-certificate)
You must enter a subdomain in the “Host Name” field. Leaving it blank will generate a root-domain certificate which is not compatible with Heroku’s SSL endpoint.
What I want is https://foo.com and https://www.foo.com to work.
So what do I need to fill in this field to get a SSL certificate that will help me achieve the above?
The rest of the steps (setting CNAME to Heroku's SSL endpoint, adding an ALIAS to redirect the root domain etc) are clear to me. I'm just stuck on this step, should it be blank or 'www' or something else?
If you want your certificate to be valid for the rood domain AND the www hostname, then you should use the www.example.com version.
You can also purchase a wildcard, but unless you need to support any extra subdomain, the cost is not worth in this case.
More details are available in the support page Selecting the Certificate Hostname.
You should fill in www.
www is just a subdomain so that will solve your www.foo.com problem but you will have to redirect the naked domain https://foo.com to the www one though.
Enter "*" for your host name, it will be valid for all subdomains including the root subdomain.