5 ms·
Announcing Better SSL for your Heroku App
- trun 14y agoHere are the new features... - Instant provisioning - Client IP address is forwarded to application as X-Forwarded-For - Better validation of certificate files - Rollback of certificate changes
- ccollins 14y ago"Client IP address is forwarded to application as X-Forwarded-For" is the biggest news here. Previously, it cost $100 per month to have access to the Client IP over SSL, so any sort of geo-location was out of the question. Insane prices for arbitrary things are why I left Heroku a few months ago and decided to custom build my servers on Linode.
- gemlogger 14y agoIsn't this just Heroku copying what cloudflare already has on offer?
- bgentry 14y agoThis is a standard HTTP Proxy header: https://en.wikipedia.org/wiki/X-Forwarded-For https://en.wikipedia.org/wiki/X-Forwarded-For
- revelation 14y agoIn fact, the "X" indicates it is not a standard header. But yes, very common for proxies to pass on.
- bradleyjg 14y agoMaybe Heroku can license the technology to Google, since the Google App Engine team has seemingly been unable to launch a similar solution three years after putting it on their roadmap.
- vailripper 14y agoDoes this support wildcard SSL certs?
- mgorsuch 14y agoIt does!
- Shanewho 14y ago$20/mo for SSL is crazy.
- jarcoal 14y agoIt's because they have to provision an Elastic Load Balancer to sit in front of your app. That's the only way they can acquire additional IP addresses from AWS. They make no money on this arrangement, they are simply passing the ELB costs on to you.
- davepeck 14y agoELB endpoints are domain names, not IP addresses. How would ELB help them "acquire additional IP addresses"?
- jarcoal 14y agoDomains that resolve to an IP... I'm not 100% sure how they are configured behind the scenes, but the ELBs have a bunch of physical IPs wired into them, so they can SSL terminate for many domains, something that EC2 instances cannot (currently) do. So Heroku leverages the ELBs to circumvent the 1 IP address per EC2 instance issue. EDIT: more info here http://serverfault.com/questions/285680/what-is-the-technology-behind-hostname-based-ssl-multiple-ssl-vhosts-on-single http://serverfault.com/questions/285680/what-is-the-technolo...
- ropiku 14y agoUnless you use SNI (which is only supported in some browsers) you have to have one IP per SSL host as the certificate is sent before decoding the request. ELB doesn't use that and must have 1 IP per hostname.
- deleted 14y ago[deleted]