4 ms·

OP here. I guess you caught me there. The SSL feature is actually still in beta, primed to ship this Monday. Being fairly new to Lets Encrypt and the eco syste

by tnolet 8y ago

OP here. I guess you caught me there. The SSL feature is actually still in beta, primed to ship this Monday. Being fairly new to Lets Encrypt and the eco system around it Checkly is mostly being cautious. Having a none SSL encrypted dash for the trial is probably fine. If this whole process runs super smoothly, we will lift this blockade. Also, I come from the days where I had to call Verisign in Switzerland and fax in my passport details...

plasma 8y ago
Assuming you have something like customer_name.myapp.com as your dashboard URL, a once-off wildcard SSL for *.myapp.com should suffice, in case you are needing to grab one for each user?
- tnolet 8y ago
  Yes, you are correct for all the customer.checklyhq.com URLs. This everyone gets because it is part of the general wildcard SSL certificate for *.checklyhq.com. However, customers want to have https://status.example.com https://status.example.com for their status pages. This is why we need to provide custom SSL certificates using Lets Encrypt.
  - ec109685 8y ago
    Hope customers don’t have cookies scoped to *.example.com
  - cyberferret 8y ago
    That shouldn't be an issue. Having a wildcard cert for .checklyhq.com shouldn't preclude you from having a separate subdomain cert for blog.checklyhq.com etc. In fact, we do this for our own SaaS and never had a problem. Our AWS instance is protected by *.mydomain.com SSL cert but we have other servers running on digital ocean etc. that have their own subdomains and their own SSL certs. The tricky thing for us is to filter out the subdomains that we use (e.g. [blog,status,www]), and prevent our customers from using them as their own custom subdomains with our app otherwise our whole DNS redirection doesn't work.
    - imhoguy 8y ago
      Rich subdomain blacklist should do the trick. Or alternative is: .app.mydomain.com or .mydomainapp.com Eventually require customers to have at least 4 characters names.
ndnxhs 8y ago
Having no SSL in a trial will probably make customers worry about the products security and the competence of the devs.
- tnolet 8y ago
  I think you are right about this. The moment I can switch it out to every other trial user I will probably do it. Just want to give the Lets Encrypt integration a bit of a trial period before going 100% in.

by tnolet 8y ago

plasma 8y ago

Assuming you have something like customer_name.myapp.com as your dashboard URL, a once-off wildcard SSL for *.myapp.com should suffice, in case you are needing to grab one for each user?

tnolet 8y ago
Yes, you are correct for all the customer.checklyhq.com URLs. This everyone gets because it is part of the general wildcard SSL certificate for *.checklyhq.com. However, customers want to have https://status.example.com https://status.example.com for their status pages. This is why we need to provide custom SSL certificates using Lets Encrypt.
- ec109685 8y ago
  Hope customers don’t have cookies scoped to *.example.com
- cyberferret 8y ago
  That shouldn't be an issue. Having a wildcard cert for .checklyhq.com shouldn't preclude you from having a separate subdomain cert for blog.checklyhq.com etc. In fact, we do this for our own SaaS and never had a problem. Our AWS instance is protected by *.mydomain.com SSL cert but we have other servers running on digital ocean etc. that have their own subdomains and their own SSL certs. The tricky thing for us is to filter out the subdomains that we use (e.g. [blog,status,www]), and prevent our customers from using them as their own custom subdomains with our app otherwise our whole DNS redirection doesn't work.
  - imhoguy 8y ago
    Rich subdomain blacklist should do the trick. Or alternative is: .app.mydomain.com or .mydomainapp.com Eventually require customers to have at least 4 characters names.

ndnxhs 8y ago

Having no SSL in a trial will probably make customers worry about the products security and the competence of the devs.

tnolet 8y ago
I think you are right about this. The moment I can switch it out to every other trial user I will probably do it. Just want to give the Lets Encrypt integration a bit of a trial period before going 100% in.