4 ms·
If you're having issues with people accessing your running Heroku apps, it's likely because you're running your DNS through herokussl.com (with their SSL endpoi
by bgentry 10y ago
If you're having issues with people accessing your running Heroku apps, it's likely because you're running your DNS through herokussl.com (with their SSL endpoint product) which is hosted on Dyn.
If you can update your DNS to CNAME directly to the ELB behind it, it should at least make your site accessible.
- asdf333 10y agothanks for the tip! how did you determine the ELB address behind the ssl endpoint? edit: figured it out. What i did was do: nslookup your-SSL-endpoint.herokussl.com then you'll see the elb address. Switch to the openDNS servers helpfully pointed out by someone above first...
- Artemis2 10y agoPresumably with something like `dig @208.67.220.220 -t CNAME <your site>.herokussl.com`. This uses the OpenDNS nameservers, that people have been reporting as working. Haven't tested it as I am on the go.
- asdf333 10y agothanks! figured it out but appreciate the help!!
- natashabaker 10y agoI'm seeing "connection timed out; no servers could be reached". Anyone else seeing that when trying to run the above command?
- asdf333 10y agodid you switch your computer's dns servers to openDNS? 208.67.222.222 208.67.220.220 (or specify dns server in the command)
- natashabaker 10y agoYes we did dig @208.67.220.220 -t CNAME <ssl-endpoint>.herokussl.com. And we got the following SERVFAIL error: ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: <id> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;<end-point>.herokussl.com. IN CNAME ;; Query time: 1226 msec ;; SERVER: <server>#53(<server>) ;; WHEN: Fri Oct 21 12:27:55 2016 ;; MSG SIZE rcvd: 44
- asdf333 10y agotry nslookup your-SSL-endpoint.herokussl.com the dig command does not work for me either... ================================= nslookup iwate-2009.herokussl.com Server: 208.67.222.222 Address: 208.67.222.222#53 Non-authoritative answer: iwate-2009.herokussl.com canonical name = elb030330-152447250.us-east-1.elb.amazonaws.com. Name: elb030330-152447250.us-east-1.elb.amazonaws.com Address: 54.225.242.254 Name: elb030330-152447250.us-east-1.elb.amazonaws.com Address: 54.225.217.226 Name: elb030330-152447250.us-east-1.elb.amazonaws.com Address: 54.235.181.244
- natashabaker 10y agoIn that case I get: ;; Got SERVFAIL reply from 10.17.100.2, trying next server Server: 10.17.100.2 Address: 10.17.100.2#53 server can't find <sslendpoint>.herokussl.com: NXDOMAIN
- asdf333 10y agomaybe try this and replace w/ ur sslendpoint? see if that works? this works for me. http://network-tools.com/nslook/Default.asp?domain=iwate-2009.herokussl.com&type=255&server=208.67.222.222&class=1&port=53&timeout=5000&go.x=21&go.y=14 http://network-tools.com/nslook/Default.asp?domain=iwate-200...
- natashabaker 10y agoOk figured it out. It was actually an issue with cloudflare being affected by the Dyn issue, rather than a heroku-ssl problem. Thanks for the help.
- deleted 10y ago[deleted]
- gkop 10y agoAnother option may be to switch from the SSL endpoint add-on to the new, free SNI-based SSL termination feature, which will mean CNAMEing to your-domain.herokudns.com. , which seems not to be affected by today's issues.
- throwaway5345 10y agoNice, this is working well for us too. We were able to get the CNAME of the ELB by doing a `dig whatever.ourdomain.com` in an EC2 instance we launched in São Paulo (which presumably worked since Dyn's outage is primarily affecting their east coast PoPs.)