2 ms·
I didn't say that it was easy. I enumerated three things that it can't be. Given that Heroku is already generating certs on the fly for the (randomly named) dy
by Karunamon 10y ago
I didn't say that it was easy. I enumerated three things that it can't be.
Given that Heroku is already generating certs on the fly for the (randomly named) dynos, offering that is even more engineering work than just sending a cert request for a custom domain, the numbers of which will be significantly smaller. [DISREGARD THIS - no they're not. Those are all on a single wildcard]
My whole gist here is that every conceivable practical excuse I can think of for not extending that feature out to custom domains resolves as a nonissue, which only leaves feature differentiation to drive sales as the remaining option.
Which, as mentioned before, is a legitimate business tactic, but morally evil in the security climate of 201x+.
- packetized 10y agoThey aren't generating certs on the fly for randomly named dynos: -bash-4.1$ curl -vkLs https://wind-river-5693.herokuapp.com 2>&1 | grep certificate * Server certificate: *.herokuapp.com * Server certificate: DigiCert SHA2 High Assurance Server CA * Server certificate: DigiCert High Assurance EV Root CA -bash-4.1$
- Karunamon 10y agoFoo! Okay, I thought they were doing LE certs for every dyno's name. One wildcard makes a lot more sense.
- packetized 10y agoFTA: ACM handles all aspects of SSL/TLS certificates for _custom domains_; you no longer have to purchase certificates, or worry about their expiration or renewal. Emphasis mine.