6 ms·

SSL Is Now Included on All Paid Dynos

75 points by edmorley 10y ago

edmorley 10y ago
This makes a big difference to small projects using the $7 hobby dynos, where the $20 of the SSL Endpoint add-on made Heroku less attractive than other options. I'm interested to know how performance compares to the add-on, which uses a dedicated ELB per app (which is why it cost $20). On the one hand I would imagine switching to this new feature removes the need to pre-warm the endpoint (https://devcenter.heroku.com/articles/ssl-endpoint#performance https://devcenter.heroku.com/articles/ssl-endpoint#performan...), but on the other could presumably introduce noisy neighbour issues. "we will be rolling out exciting new features to it over the coming months" ...native Let's Encrypt support perhaps? :-)
dtnewman 10y ago
I've been using this in beta for some of my personal projects that run on hobby dynos. This doesn't actually give you the certificates, it just allows you to upload the certificates you get elsewhere to heroku and then configures the server for your heroku app from there. I find it very helpful to be able to do this for free... for some of my hobby projects, it's cost prohibitive to spend more than a few dollars a month on SSL. If you want to get the certificates for free as well, there's a guide at the link below that can help for setting this up with Let's Encrypt. The title is "LET'S ENCRYPT WITH A RAILS APP ON HEROKU", but I followed mostly the same steps for a Flask/Python app and it worked fine. The only step that was Rails specific was for setting up a route to the verification content, which is pretty easy to do in any framework that I can think of (to verify the website's ownership, Let's Encrypt makes you setup an endpoint at <your-site>/.well-known/acme-challenge/<verification-string-they-give-you> that simply returns a long random string they give you in the CLI). See: http://collectiveidea.com/blog/archives/2016/01/12/lets-encrypt-with-a-rails-app-on-heroku/ http://collectiveidea.com/blog/archives/2016/01/12/lets-encr...
Artemis2 10y ago
Why not automatically provision Let's Encrypt certificates for associated domains?
- tal_berzniz 10y ago
  We've set it up in our company with NGINX and LUA (https://github.com/GUI/lua-resty-auto-ssl https://github.com/GUI/lua-resty-auto-ssl) and it works great
darkxanthos 10y ago
I seriously had no idea Heroku was still even actively being worked on. Nice to see a much needed upgrade!
jakewins 10y ago
The irony of doing this on Heroku, when the push for encryption that surely influenced this work reached escape velocity from the same Snowden leaks that said "oh, and anything at all that you store with AWS is open season to the NSA". So it's Heroku reacting to that push by encrypting inbound data, and then storing it in a cloud with zero privacy protection. Which, I don't mean to be cynical - it's way better than not encrypting at all, it's just a bit funny, in a sad, Orwellian way.
- koolba 10y ago
  > So it's Heroku reacting to that push by encrypting inbound data, and then storing it in a cloud with zero privacy protection. What data are they storing? I'm pretty sure they just pipe the inbound request to whatever process is running your app. They (Heroku) aren't saving every request or response body. It'd be an insane amount of traffic. Now someone could tap into that but none of this makes things less secure. They're just changing the way inbound SSL is handled by offering free SNI based SSL to everybody. That's a good thing, not a bad thing. The alternative is having a dedicated endpoint per application serving the exact certificate for that app (which is why the cost for it was non-free before).
jalada 10y ago
Woohoo! I'm sure eventually they'll add automatic LetsEncrypt certificates too. But in the meantime if you're using Ruby on Rails on Heroku, this gem (that I made) will probably help: https://github.com/pixielabs/letsencrypt-rails-heroku https://github.com/pixielabs/letsencrypt-rails-heroku
- Sachse 10y ago
  This is what I've been using for the last month or so, it's been working really well! Thanks for the gem!
dahdum 10y ago
I don't often visit Heroku but it's always a trip to see their pricing. It's like the past 8 years of hardware cost reductions never happened, and you're still stuck paying $25/month for 512MB ram.
- nkg 10y ago
  What other platform would you recommend? I'm considering moving my next hobby app somewhere else...
  - andrewstuart2 10y ago
    Move to an open-source orchestration platform and turn compute into a commodity so you don't feel tied to any particular VM vendor. I recommend Kubernetes, but there's also docker swarm, mesos, Nomad, Rancher, and probably about 100 other options out there, many of them very viable. In the very near future I really hope to see cloud vendors losing a lot of their business for hosted applications, and just becoming big elastic pools of bytes and FLOPs, with open source orchestration tools managing the consumption of those resources and keeping cognitive overhead low.
    - saool 10y ago
      I must be out of date, but my impression is that heroku's ease of use deploying and configuring applications through the web UI can't really be matched with kubernetes, mesos or others, which would need thousands of lines of orchestration code to work. Is that not the case anymore?
      - praneshp 10y ago
        Re Kubernetes, there will be some extra lines of course, but I really doubt it will run into the thousands. For example, I have a few (test) apps running on a (test) k8s cluster with a few small yaml files and a small shell script to build a docker image.
    - dahdum 10y ago
neoCrimeLabs 10y ago
I know some people use SSL and TLS interchangeably, but just in case, I'd recommend using TLS not SSL. SSLv2 and SSLv3 have known security issues and have been superseded by TLSv1 and above. Also, here's a great server side TLS guide that explains best practices for TLS: https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS
- brettgoulder 10y ago
  Sorry about the confusion. It is all TLS under the hood, SSLv3 is completely disabled: https://devcenter.heroku.com/articles/ssl#supported-ssl-protocols https://devcenter.heroku.com/articles/ssl#supported-ssl-prot...
Mizza 10y ago
If you're a Python user, there is absolutely no reason to user Heroku over Zappa[0]. Zappa is cheaper (usually free), it's faster, it has auto-renewing Let's Encrypt certs out of the box, it doesn't have a warm-up time, it's more scalable and you never have to worry about ops. Heroku's day has come and gone, quite frankly. Obviously, I'm biased because I'm the author, but you should evaluate it for yourself. [0] https://github.com/Miserlou/Zappa https://github.com/Miserlou/Zappa
- mtmail 10y ago
  Missing disclaimer: you're one of the main authors of zappa and sell training and support packages.
  - Mizza 10y ago
    This is true, disclaimer added (although it's so easy to use, I've never actually sold any :) I worked for free for six months to make an open source project that's better than Heroku so I don't feel bad about promoting it.). But, it's still absolutely true. For Python users, you should use Zappa for web apps and ECS for anything that requires long-running processes. I just don't see how Heroku makes sense any more.

75 points by edmorley 10y ago

This makes a big difference to small projects using the $7 hobby dynos, where the $20 of the SSL Endpoint add-on made Heroku less attractive than other options. I'm interested to know how performance compares to the add-on, which uses a dedicated ELB per app (which is why it cost $20). On the one hand I would imagine switching to this new feature removes the need to pre-warm the endpoint (https://devcenter.heroku.com/articles/ssl-endpoint#performance https://devcenter.heroku.com/articles/ssl-endpoint#performan...), but on the other could presumably introduce noisy neighbour issues. "we will be rolling out exciting new features to it over the coming months" ...native Let's Encrypt support perhaps? :-)

dtnewman 10y ago

I've been using this in beta for some of my personal projects that run on hobby dynos. This doesn't actually give you the certificates, it just allows you to upload the certificates you get elsewhere to heroku and then configures the server for your heroku app from there. I find it very helpful to be able to do this for free... for some of my hobby projects, it's cost prohibitive to spend more than a few dollars a month on SSL. If you want to get the certificates for free as well, there's a guide at the link below that can help for setting this up with Let's Encrypt. The title is "LET'S ENCRYPT WITH A RAILS APP ON HEROKU", but I followed mostly the same steps for a Flask/Python app and it worked fine. The only step that was Rails specific was for setting up a route to the verification content, which is pretty easy to do in any framework that I can think of (to verify the website's ownership, Let's Encrypt makes you setup an endpoint at <your-site>/.well-known/acme-challenge/<verification-string-they-give-you> that simply returns a long random string they give you in the CLI). See: http://collectiveidea.com/blog/archives/2016/01/12/lets-encrypt-with-a-rails-app-on-heroku/ http://collectiveidea.com/blog/archives/2016/01/12/lets-encr...

Artemis2 10y ago

Why not automatically provision Let's Encrypt certificates for associated domains?

tal_berzniz 10y ago
We've set it up in our company with NGINX and LUA (https://github.com/GUI/lua-resty-auto-ssl https://github.com/GUI/lua-resty-auto-ssl) and it works great

darkxanthos 10y ago

I seriously had no idea Heroku was still even actively being worked on. Nice to see a much needed upgrade!

jakewins 10y ago

The irony of doing this on Heroku, when the push for encryption that surely influenced this work reached escape velocity from the same Snowden leaks that said "oh, and anything at all that you store with AWS is open season to the NSA". So it's Heroku reacting to that push by encrypting inbound data, and then storing it in a cloud with zero privacy protection. Which, I don't mean to be cynical - it's way better than not encrypting at all, it's just a bit funny, in a sad, Orwellian way.

koolba 10y ago
> So it's Heroku reacting to that push by encrypting inbound data, and then storing it in a cloud with zero privacy protection. What data are they storing? I'm pretty sure they just pipe the inbound request to whatever process is running your app. They (Heroku) aren't saving every request or response body. It'd be an insane amount of traffic. Now someone could tap into that but none of this makes things less secure. They're just changing the way inbound SSL is handled by offering free SNI based SSL to everybody. That's a good thing, not a bad thing. The alternative is having a dedicated endpoint per application serving the exact certificate for that app (which is why the cost for it was non-free before).

jalada 10y ago

Woohoo! I'm sure eventually they'll add automatic LetsEncrypt certificates too. But in the meantime if you're using Ruby on Rails on Heroku, this gem (that I made) will probably help: https://github.com/pixielabs/letsencrypt-rails-heroku https://github.com/pixielabs/letsencrypt-rails-heroku

Sachse 10y ago
This is what I've been using for the last month or so, it's been working really well! Thanks for the gem!

dahdum 10y ago

I don't often visit Heroku but it's always a trip to see their pricing. It's like the past 8 years of hardware cost reductions never happened, and you're still stuck paying $25/month for 512MB ram.

nkg 10y ago
What other platform would you recommend? I'm considering moving my next hobby app somewhere else...
- andrewstuart2 10y ago
  Move to an open-source orchestration platform and turn compute into a commodity so you don't feel tied to any particular VM vendor. I recommend Kubernetes, but there's also docker swarm, mesos, Nomad, Rancher, and probably about 100 other options out there, many of them very viable. In the very near future I really hope to see cloud vendors losing a lot of their business for hosted applications, and just becoming big elastic pools of bytes and FLOPs, with open source orchestration tools managing the consumption of those resources and keeping cognitive overhead low.
  - saool 10y ago
    I must be out of date, but my impression is that heroku's ease of use deploying and configuring applications through the web UI can't really be matched with kubernetes, mesos or others, which would need thousands of lines of orchestration code to work. Is that not the case anymore?
    - praneshp 10y ago
      Re Kubernetes, there will be some extra lines of course, but I really doubt it will run into the thousands. For example, I have a few (test) apps running on a (test) k8s cluster with a few small yaml files and a small shell script to build a docker image.
  - dahdum 10y ago

neoCrimeLabs 10y ago

I know some people use SSL and TLS interchangeably, but just in case, I'd recommend using TLS not SSL. SSLv2 and SSLv3 have known security issues and have been superseded by TLSv1 and above. Also, here's a great server side TLS guide that explains best practices for TLS: https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS

brettgoulder 10y ago
Sorry about the confusion. It is all TLS under the hood, SSLv3 is completely disabled: https://devcenter.heroku.com/articles/ssl#supported-ssl-protocols https://devcenter.heroku.com/articles/ssl#supported-ssl-prot...

Mizza 10y ago

If you're a Python user, there is absolutely no reason to user Heroku over Zappa[0]. Zappa is cheaper (usually free), it's faster, it has auto-renewing Let's Encrypt certs out of the box, it doesn't have a warm-up time, it's more scalable and you never have to worry about ops. Heroku's day has come and gone, quite frankly. Obviously, I'm biased because I'm the author, but you should evaluate it for yourself. [0] https://github.com/Miserlou/Zappa https://github.com/Miserlou/Zappa

mtmail 10y ago
Missing disclaimer: you're one of the main authors of zappa and sell training and support packages.
- Mizza 10y ago
  This is true, disclaimer added (although it's so easy to use, I've never actually sold any :) I worked for free for six months to make an open source project that's better than Heroku so I don't feel bad about promoting it.). But, it's still absolutely true. For Python users, you should use Zappa for web apps and ECS for anything that requires long-running processes. I just don't see how Heroku makes sense any more.