4

In this post, the author suggest a way to get SSL on Heroku without paying Heroku for it:

  1. Pay Cloudflare for premium service, and get SSL support with it.
  2. Create a CNAME in cloudflare that points to the Heroku subdomain of your app (appname.herokuapp.com), which piggybacks Heroku's SSL.

Is there any potential issue with such a method?

Improve this question
1
  • I'm using this method on multiple domains with cloudflare/heroku. No issues :)
    – mscccc
    Commented Jan 14, 2014 at 12:52

1 Answer 1

Reset to default
3

You can use CloudFlare's paid level plan (pro or above) and then use our Flexible SSL option which means we'd be connecting to your back-end (like Heroku in this case) over HTTP ...meaning you would not need to have SSL enabled at Heroku.

So with Flexible SSL this is how things look --

visitor <-- HTTPS --> CloudFlare <-- HTTP --> Heroku

Discussed here also: https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-three-SSL-options-off-Flexible-Full-mean-

so with Flexible SSL your visitors can still access your website using HTTPS, but CloudFlare would be connecting to your back-end at Heroku using HTTP.

p.s. in the future I would recommend opening a support ticket with CloudFlare directly. Our support team would be able to answer this question for you quickly. :)

Improve this answer
3
  • 1
    Er isn't this a security risk? If I log in, will you be transmitting my password in the clear to Heroku? Heroku provides SSL (for herokuapps.com) for nothing; surely it's best for CF to connect to that?
    – Rob Grant
    Commented Aug 15, 2014 at 13:52
  • Since Heroku is providing SSL for your origin then yes -- you could use the Full SSL option instead. I thought you had to pay for SSL at Heroku no matter what? Apologies if I misunderstood -- or perhaps they started offering free SSL since December 2013 when I posted this?
    – xxdesmus
    Commented Aug 15, 2014 at 20:35
  • Yeah quite possibly it's started since then. All I know is if I go to https instead of http for herokuapps.com, it works and is signed by DigitalCerts. Might be worth updating this answer, as I'd say it's not good advice now.
    – Rob Grant
    Commented Aug 18, 2014 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.