Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a domain name tradespring.net, and www.tradespring.net that redirect to my Heroku app with a CNAME record. However when I first try to access these sites it gives me a malicious warning.

This is probably not the site you are looking for! blah blah blah then "proceed anyways" or "back to safety"

Its because my browser realizes that it is redirecting. How can I make sure anyone's browser (not just my browser) trusts this site and my Heroku app?

I don't think i need an SSL certificate because this site is not sending sensitive info (credit card info, etc.).

share|improve this question
    
Have you purchased your own SSL certificate? –  Anagio Jul 24 '12 at 22:16
add comment

3 Answers

I don't think i need an SSL certificate because this site is not sending sensitive info (credit card info, etc.).

So then why is your app 301 redirecting HTTP to the HTTPS site? Don't do that and you won't get the certificate warning.

Have you followed these directions?

share|improve this answer
    
yeah those are the directions I followed. I set up a CNAME record from tradespring.net (http) to tradespring.herokuapp.com (https). –  BigBoy1337 Jul 24 '12 at 23:28
    
Strange, according to this devcenter.heroku.com/articles/maximizing-availability/#dns__ssl it says Apps on the Cedar stack should have CNAME records pointing to app-name.herokuapp.com. When SSL is required provision an SSL Endpoint and point your CNAME records to endpoint-name.herokussl.com. Any other configuration will result in reduced availability. That leads me to believe it should not be ssl if your using herokuapp.com –  Anthony Hatzopoulos Jul 24 '12 at 23:37
    
CNAMEs do not use protocol's either. somewhere on tradespring.net you must have a 301 redirect. Maybe it's inside .htaccess ? –  Anthony Hatzopoulos Jul 24 '12 at 23:41
add comment

Check your .htaccess file for a http to https redirect and remove it.

Since your website does not handle sensitive information, you need not waste money on an SSL certificate.

https:// is used only when there is a valid SSL certificate installed on the server. An error will be thrown if the certificate is missing.

share|improve this answer
add comment

You'll need to get your own SSL

"This warning is presented by a web browser when accessing a website that has a security certificate installed (for data encryption) that was issued to a domain other than the one being accessed."

http://www.digicert.com/ssl-support/certificate-name-mismatch-error.htm

In Chrome it tells me

"Google Chrome can say for sure that you reached *.herokuapp.com, but cannot verify that that is the same site as www.tradespring.net which you intended to reach. If you proceed, Chrome will not check for any further name mismatches."
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.