17 ms·
Use LetsEncrypt and CloudFlare to secure any Heroku app for free
- CiPHPerCoder 10y agoPlease do keep in mind that CloudFlare is essentially a consensual man-in-the-middle and for certain threat models is not compatible with the "secure" modifier. If your threat model differs, this is cool.
- maxehmookau 10y agoWe're suggesting CloudFlare as its one of the few DNS providers that supports SSL at the domain apex on Heroku. I wouldn't recommend using their built-in SSL solution though and it's easy to turn off.
- aeden 10y agoThere are multiple providers supporting CNAME-like functionality on the apex that are compatible with Heroku (and other hostname-based endpoints): * Cloudflare * DNSMadeEasy * DNSimple (my company) * easydns * PointDNS I'm certain more will support it as open source name servers add support.
- devnull42 10y agoCNAMEs at apexes make my heart hurt so much.
- andrewvc 10y agoWell if you're using Heroku you already have that man in the middle via their routing layer
- gleenn 10y agoThey have a lot more control that just the routing layer. They own your process, they have your source code, they have your API keys. There is a huge implicit trust in Heroku. It is my host of choice but they definitely own the keys to the palace.
- xxdesmus 10y agoWelcome to the internet -- what you actually just said was: "[The Cloud] is essentially a consensual man-in-the-middle and for certain threat models is not compatible with the 'secure' modifier."
- CiPHPerCoder 10y agoThat's simultaneously wrong and misleading. "The Cloud" isn't a company that has direct access to a certificate authority. "The Cloud" doesn't produce a valid TLS certificate for YOUR website, to encrypt the connection between them and your visitors, but not necessarily between them and your server. "The Cloud" is a vague term for "other people's computers". CloudFlare is better than plaintext HTTP, but if your goal is confidentiality, then CloudFlare is probably worse than direct HTTPS with no intermediaries. Again, threat models differ. For most people, CloudFlare is probably just fine.
- ctz 10y agoYes. Some people have confused themselves into thinking TLS is end-to-end, when it's only point-to-point. Not specific to cloudflare; Google did this for years and the NSA took advantage of that (hence the "SSL added and removed here" thing).
- samwillis 10y agoDo also keep in mind that ssl on Heroku is terminated at their routing layer before your Dynos. Therefore it is as easy for Heroku (Salesforce) to man-in-the-middle your application as it is for CloudFlare, whether that be on instruction for the authorities or due to a bad actor on the staff. Both of them you have to trust to do the right thing and that is an exercise left to the individual thinking of using either service. So lets not pretend that CloudFlare is a special case. If you need to trust the none of your service providers can MITM your site then you can't use any PaaS or CDN, you need to terminate the SSL yourself, that includes for all static assets you use. No more jQuery from Google CDN, no more analytics/exception tracking/fonts from your favoured provider and no more advertising conversion tracking. But then do also remember that it's possible for any web host to take over their customers site as long as they own the IP address. They just point the IP to another server, configure it to respond to the hostname and they can then even use any SSL certificate provider who validates the domain name with a file at a specific URL to grab a certificate. Everyone has to make their own judgment on who they can trust. CloudFlare is no different.
- dublinben 10y ago>No more jQuery from Google CDN, no more analytics/exception tracking/fonts from your favoured provider and no more advertising conversion tracking Those all sound like reasonable best practices for building a website.
- chronic81 10y agoIt is unfortunate that you grew up with such web tools as it is trivial to host them yourself.
- JohnTHaller 10y agoExcept for the part where anyone you'd like to partner with isn't going to trust your internal analytics to gauge your popularity. One of the points of third party analytics is that you have a disinterested third party who can provide the data to someone else.
- samwillis 10y ago
- nstj 10y agoCloudflare may not be as awesome as everyone makes it out to be. Discuss.
- maxehmookau 10y agoFor this use case it really is. The number of DNS providers that have support for SSL at the domain apex using ALIAS or ANAME records could be counted on one hand. You don't have to use any of the CloudFlare specific features, but their DNS management is really good.
- stryk 10y agoWould you mind elaborating as to which few specific DNS providers those are?
- maxehmookau 10y agoSure! Heroku have a list here https://devcenter.heroku.com/articles/custom-domains#configuring-dns-for-root-domains https://devcenter.heroku.com/articles/custom-domains#configu...
- stryk 10y agoThanks, cheers
- fapjacks 10y agoExcept they don't support ANY queries because it costs too much.
- dmathieu 10y agoOr, if you want to just provision a letsencrypt certificate on Heroku without cloudflare: https://github.com/dmathieu/sabayon https://github.com/dmathieu/sabayon
- xutopia 10y agoIs it possible to do this on the fly with subdomains? I have a specific problem with my instance where I have multiple domains and multiple subdomains. Right now I use a wildcard SSL because the subdomains are generated on the fly whenever a new client signs up. Is it possible to create a new certificate without restarting all the servers each time a new client signs up?
- dmathieu 10y agoNo, that is not possible with the sabayon architecture. It needs to store letsencrypt key/token for all domains, and stores them as config vars. You'd have to store them in a database for example to avoid having to restart the app. But that wouldn't be a good solution either, as letsencrypt will not allow you to have more than 100 domains under the same certificate.
- antonplus 10y agoThe issue I've had with LetsEncrypt is the short expirations. LetsMonitor.org sets up an alert system for expirations
- dopamean 10y agoThe system is intended to be automated. If you're manually renewing your cert every 60-90 days you're doing it wrong.
- gardenforce 10y agoIt's third party validation just in case the certs don't auto-renew for whatever reason. We have 40+ domains and I sleep better with multiple levels of monitoring.
- Karunamon 10y agoUntil they get nginx support working (the letsencrypt-auto tool still bangs on about its support being buggy and experimental), I don't have many options.
- icebraining 10y agoI can't recommend acme-tiny enough. I have cron calling a very short script every month that uses openssl & acme-tiny to renew the cert, and by adding a 'location' block to my nginx configs, they don't need to be touched during renovation.
- rolodato 10y agoIn my experience it wasn't necessary to set up an external notification system. I got an email from expiry@letsencrypt.com 10 days before the expiration. But it's true that on Heroku it's meant to be used with automated renewals.
- naratako 10y agoI can see them all at once: https://letsmonitor.org/images/landing/laptop.png https://letsmonitor.org/images/landing/laptop.png
- xutopia 10y agoIs it possible to use this with multiple subdomains? I have multiple domains pointing to an heroku instance and each domain has multiple subdomains. Insofar as I understood LetsEncrypt does not support wildcard SSL but is it possible to use this tool (or another) to secure all subdomains as well?
- maxehmookau 10y agoYep. Just pass in a comma delimited list to the subdomains parameters (subdomains=www,hello,another,test) and it'll add all of them to the certificate.
- moron4hire 10y agoIs there a limit? Last I heard you could do up to 100 that way. That'd certainly be enough for my own needs (if I were using LetsEncrypt), but I don't know about other people.
- maxehmookau 10y agoWe wrote a blog post about it too https://substrakt.com/heroku-ssl-me-weve-come-a-long-way/ https://substrakt.com/heroku-ssl-me-weve-come-a-long-way/
- baus 10y agoJust to clarify, is traffic unencrypted between CloudFlare and Heroku? Are those connections over the public internet?
- samwillis 10y agoCloudFlare is only providing DNS, no traffic goes though it in this instance. It is trivial however to setup CloadFlare to have encrypted traffic to your Heroku app for free when using their cdn/webapp firewall service as your app is on https://appname.herokuapp.com https://appname.herokuapp.com which CloudFlare proxy.
- joeblau 10y agoI'm using Cloudflare + Heroku to host https://www.gitignore.io https://www.gitignore.io [0], but I'm not using a LetsEncrypt certificate. I'm just using Cloudflare's Universal SSL[1] certificate. So far everything with Cloudflare has been amazing; they even prevented a 99 million+ request DDOS attack on my site a few years ago. [0] - https://github.com/joeblau/gitignore.io/wiki/System-Architecture https://github.com/joeblau/gitignore.io/wiki/System-Architec... [1] - https://blog.cloudflare.com/introducing-universal-ssl/ https://blog.cloudflare.com/introducing-universal-ssl/
- cmalpeli 10y agoWould this solution allow one to secure multiple TLDs on one Heroku endpoint/application?
- maxehmookau 10y agoNot currently but it's on the roadmap.