Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

In this post, the author suggest a way to get SSL on Heroku without paying Heroku for it:

  1. Pay Cloudflare for premium service, and get SSL support with it.
  2. Create a CNAME in cloudflare that points to the Heroku subdomain of your app (appname.herokuapp.com), which piggybacks Heroku's SSL.

Is there any potential issue with such a method?

share|improve this question
    
I'm using this method on multiple domains with cloudflare/heroku. No issues :) –  mscccc Jan 14 at 12:52

1 Answer 1

You can use CloudFlare's paid level plan (pro or above) and then use our Flexible SSL option which means we'd be connecting to your back-end (like Heroku in this case) over HTTP ...meaning you would not need to have SSL enabled at Heroku.

So with Flexible SSL this is how things look --

visitor <-- HTTPS --> CloudFlare <-- HTTP --> Heroku

Discussed here also: https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-three-SSL-options-off-Flexible-Full-mean-

so with Flexible SSL your visitors can still access your website using HTTPS, but CloudFlare would be connecting to your back-end at Heroku using HTTP.

p.s. in the future I would recommend opening a support ticket with CloudFlare directly. Our support team would be able to answer this question for you quickly. :)

share|improve this answer
1  
Er isn't this a security risk? If I log in, will you be transmitting my password in the clear to Heroku? Heroku provides SSL (for herokuapps.com) for nothing; surely it's best for CF to connect to that? –  Robert Grant Aug 15 at 13:52
    
Since Heroku is providing SSL for your origin then yes -- you could use the Full SSL option instead. I thought you had to pay for SSL at Heroku no matter what? Apologies if I misunderstood -- or perhaps they started offering free SSL since December 2013 when I posted this? –  xxdesmus Aug 15 at 20:35
    
Yeah quite possibly it's started since then. All I know is if I go to https instead of http for herokuapps.com, it works and is signed by DigitalCerts. Might be worth updating this answer, as I'd say it's not good advice now. –  Robert Grant Aug 18 at 8:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.