3 ms·

You can always get the certificate yourself and then upload it to Heroku. You own the custom domain, so you can use dns-01 instead of http-01 verification. Or,

You can always get the certificate yourself and then upload it to Heroku. You own the custom domain, so you can use dns-01 instead of http-01 verification. Or, as others mentioned, the default endpoint is SSL-enabled.

Karunamon 10y ago
That's just the problem, though. The level of labor for Heroku enabling for everyone is negligible, and holding out on basic security as a paid addon in 2017 is just plain reprehensible. HTTPS should be the bare minimum for all connections in 2017, with HTTP fallback if requested. That should be the paid add-on. I really don't see how this is such an unreasonable sentiment that it deserves maximum downvotes.
- sanswork 10y ago
  As others have said though they aren't holding out on basic security. They are holding out on custom domains with security. They provide SSL for free if you don't use a custom domain. It's unreasonable because they provide what you are asking for at a free price point and you're complaining "Not enough!".
  - Karunamon 10y ago
    You're right. Holes in basic SSL stuff, custom domain or otherwise, leading to insecure defaults are "not enough". People need to really start demanding more from their hosting providers. Then again, this is the Heroku that sent Rap Genius on a months long troubleshooting spree and tens of thousands in expense due to poor documentation, so perhaps I should just mentally file them in the same bucket as Godaddy and be done with it.
    - sanswork 10y ago
      Given your apparent unwillingness to pay for any of their services anyhow I'm guessing this mental filing will only serve to save them money.
- mattzito 10y ago
  > The level of labor for Heroku enabling for everyone is negligible This is simply not true. Implementing LE support for more than a handful of domains is a significant amount of work, particularly when you don't control the domains in question.
  - Karunamon 10y ago
    Not when you control the endpoint that the domain will be pointed at, as Heroku does. LE verification via file consists of files shoved in the web root at /.well-known. Given that they already have the infrastructure in place and have just arbitrarily turned it off, these complaints of scale ring quite hollow. The storage and data transfer involved is tiny.

Karunamon 10y ago

That's just the problem, though. The level of labor for Heroku enabling for everyone is negligible, and holding out on basic security as a paid addon in 2017 is just plain reprehensible. HTTPS should be the bare minimum for all connections in 2017, with HTTP fallback if requested. That should be the paid add-on. I really don't see how this is such an unreasonable sentiment that it deserves maximum downvotes.

sanswork 10y ago
As others have said though they aren't holding out on basic security. They are holding out on custom domains with security. They provide SSL for free if you don't use a custom domain. It's unreasonable because they provide what you are asking for at a free price point and you're complaining "Not enough!".
- Karunamon 10y ago
  You're right. Holes in basic SSL stuff, custom domain or otherwise, leading to insecure defaults are "not enough". People need to really start demanding more from their hosting providers. Then again, this is the Heroku that sent Rap Genius on a months long troubleshooting spree and tens of thousands in expense due to poor documentation, so perhaps I should just mentally file them in the same bucket as Godaddy and be done with it.
  - sanswork 10y ago
    Given your apparent unwillingness to pay for any of their services anyhow I'm guessing this mental filing will only serve to save them money.
mattzito 10y ago
> The level of labor for Heroku enabling for everyone is negligible This is simply not true. Implementing LE support for more than a handful of domains is a significant amount of work, particularly when you don't control the domains in question.
- Karunamon 10y ago
  Not when you control the endpoint that the domain will be pointed at, as Heroku does. LE verification via file consists of files shoved in the web root at /.well-known. Given that they already have the infrastructure in place and have just arbitrarily turned it off, these complaints of scale ring quite hollow. The storage and data transfer involved is tiny.