Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New TLS certificate for .herokuapp.com hostnames

devcenter.heroku.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: New TLS certificate for .herokuapp.com hostnames

#11

Post by jamil7 »

londons_explore wrote: post #9
jamil7 wrote: post #3

Heroku also doesn't enforce any verification that you own a domain name. Another user can simply add any domain they like to their app if you haven't claimed it by adding it to your app first. Regardless of ownership and you will no longer be able to add your own domain to your app getting a generic "domain is already in use" error. Happened to me a few years ago, had to reach out to support and prove I owned the dom…

As long as support can fix this, it isn't really a problem is it? If you point your domain to heroku having not set it up first, that's on you...

Yeah like I said in another comment it seems like it's normal across these paas platforms.

> If you point your domain to heroku having not set it up first, that's on you...

How is it on you? it's possible a previous owner had a heroku app with that domain attached to it or someone just added it to their app before you setup a heroku app.

Re: New TLS certificate for .herokuapp.com hostnames

#12

Post by swiley »

derision wrote: post #8
swiley wrote: post #6

Earlier quoted context omitted.

How does GitHub’s gh pages handle this? I don’t remember them doing anything either.

Pretty sure you have to set some DNS records for gh pages

Yes you have to point a record at the gh pages if you want to use dns with it, but I don’t think their server checks for that.

Re: New TLS certificate for .herokuapp.com hostnames

#13

Post by awirth »

londons_explore wrote: post #9
jamil7 wrote: post #3

Heroku also doesn't enforce any verification that you own a domain name. Another user can simply add any domain they like to their app if you haven't claimed it by adding it to your app first. Regardless of ownership and you will no longer be able to add your own domain to your app getting a generic "domain is already in use" error. Happened to me a few years ago, had to reach out to support and prove I owned the dom…

As long as support can fix this, it isn't really a problem is it? If you point your domain to heroku having not set it up first, that's on you...

You would think so, but it turns out that this ("subdomain takeovers") is a very common mis-configuration for a lot of *aaS services. Enough so that some bug bounty programs won't pay out much for it or at all because it happens so much and they don't consider the shared-suffix issue very important.

On the provider side though, requiring ownership verification (txt records, etc) introduces friction on the on-boarding process. It's likely any reasonably competent provider that doesn't implement verification has had a serious internal discussion about it and decided it's not worth thinning their funnel for.

Re: New TLS certificate for .herokuapp.com hostnames

#15

Post by awirth »

swiley wrote: post #12
derision wrote: post #8

Earlier quoted context omitted.

Pretty sure you have to set some DNS records for gh pages

Yes you have to point a record at the gh pages if you want to use dns with it, but I don’t think their server checks for that.

Is it possible to subscribe to a firehose of .COM NS record updates through one of those fancy things like dnsdb? If so, perhaps there's an opportunity here for exploiting that race condition en-masse for services that support direct NS-style delegation, like netlify.

Re: New TLS certificate for .herokuapp.com hostnames

#17

Post by jrockway »

PedroBatista wrote: post #7
abhisuri97 wrote: post #2

Wow. I really hope they’ll get it done before the expiration date but I always thought they’d be renewing months in advance at minimum. Are they trying to negotiate something?

Most likely. I'm pretty sure the money they want is something ridiculous because in their business wisdom they know Heroku has no power if they don't want to rock the boat. The question is: Is Heroku willing to rock the boat?

Let's Encrypt issues wildcard certificates, so Heroku could easily pay $0 for one. I don't think they are negotiating anything.

Re: New TLS certificate for .herokuapp.com hostnames

#18

Post by jrockway »

Something that's nice about Let's Encrypt is that it forces you to change something every few months. After the first couple months, you'll probably get your issues worked out. If you just change certs every few years, then every few years you have some sort of disaster because of the "well we fixed it, we don't have to worry for two years" effect.

A broader lesson is the importance of "trying out" rare events, even before that rare event actually happens. If depends on a service with a certain SLA, it's pretty dangerous when that service has 100% uptime. You never get to see what happens when it does go down, which it did promise you it will. Some people track their error budget, and at the end of the accounting period, break their service in accordance with the SLA. Then you get to see what happens when it does go down. (Ref: https://queue.acm.org/detail.cfm?id=2371516)

Re: New TLS certificate for .herokuapp.com hostnames

#19

Post by tempay »

jrockway wrote: post #17
PedroBatista wrote: post #7

Earlier quoted context omitted.

Most likely. I'm pretty sure the money they want is something ridiculous because in their business wisdom they know Heroku has no power if they don't want to rock the boat. The question is: Is Heroku willing to rock the boat?

Let's Encrypt issues wildcard certificates, so Heroku could easily pay $0 for one. I don't think they are negotiating anything.

The issue is that some of their customers have pinned DigiCert so they have two choices:

* pay whatever DigiCert demands for a new certificate * accept that some of their customers will break

Doing this two weeks before the old certificate expires puts them in a difficult situation for negotiating, especially now they've committed to getting a new DigiCert certificate.

Re: New TLS certificate for .herokuapp.com hostnames

#20

Post by godzillabrennus »

bad_user wrote: post #16

Why would you pin a certificate that you did not generate for a domain that's not yours?

My guess is that it is some larger corporate client with a middleware app they pinned the cert into. An app they built on Heroku hurriedly because it was fast and cheap to get started and they didn’t expect to need to scale. Then as can happen it became important and they scaled anyway. They probably lost the talent that built it so they don’t even remember how it works.

All of this is assumption based on how they seem to buy enough compute at Heroku to have sway over rolling back this change of cert provider.

Post reply on HN