Does it support wildcard?
Does not support wildcard, but it will support a multi-domain SAN cert up to 100 custom domains
Announcing Free and Automated SSL Certs
11–20 of 79 posts
Re: Announcing Free and Automated SSL Certs
#12Free SSL.. for all paid dynos. Apparently, if you're developing an application, you are expected to be okay with having your stuff MITMed. Yes, this is me being excessively negative. Not having SSL-by-default in 2017 is excessively stupid. The certs are free, the system fully automated from both sides. Why hold back? There is no excuse for not having it system wide. Unencrypted HTTP needs to start being treated as th…
You can always get the certificate yourself and then upload it to Heroku. You own the custom domain, so you can use dns-01 instead of http-01 verification. Or, as others mentioned, the default endpoint is SSL-enabled.
Re: Announcing Free and Automated SSL Certs
#13Does it support wildcard?
[deleted]
Re: Announcing Free and Automated SSL Certs
#14Free SSL.. for all paid dynos. Apparently, if you're developing an application, you are expected to be okay with having your stuff MITMed. Yes, this is me being excessively negative. Not having SSL-by-default in 2017 is excessively stupid. The certs are free, the system fully automated from both sides. Why hold back? There is no excuse for not having it system wide. Unencrypted HTTP needs to start being treated as th…
You can always get the certificate yourself and then upload it to Heroku. You own the custom domain, so you can use dns-01 instead of http-01 verification. Or, as others mentioned, the default endpoint is SSL-enabled.
That's just the problem, though. The level of labor for Heroku enabling for everyone is negligible, and holding out on basic security as a paid addon in 2017 is just plain reprehensible.
HTTPS should be the bare minimum for all connections in 2017, with HTTP fallback if requested. That should be the paid add-on.
I really don't see how this is such an unreasonable sentiment that it deserves maximum downvotes.
Re: Announcing Free and Automated SSL Certs
#15Private Spaces not supported :(
Re: Announcing Free and Automated SSL Certs
#16Earlier quoted context omitted.
You can always get the certificate yourself and then upload it to Heroku. You own the custom domain, so you can use dns-01 instead of http-01 verification. Or, as others mentioned, the default endpoint is SSL-enabled.
That's just the problem, though. The level of labor for Heroku enabling for everyone is negligible, and holding out on basic security as a paid addon in 2017 is just plain reprehensible. HTTPS should be the bare minimum for all connections in 2017, with HTTP fallback if requested. That should be the paid add-on. I really don't see how this is such an unreasonable sentiment that it deserves maximum downvotes.
As others have said though they aren't holding out on basic security. They are holding out on custom domains with security. They provide SSL for free if you don't use a custom domain.
It's unreasonable because they provide what you are asking for at a free price point and you're complaining "Not enough!".
Re: Announcing Free and Automated SSL Certs
#17Earlier quoted context omitted.
That's just the problem, though. The level of labor for Heroku enabling for everyone is negligible, and holding out on basic security as a paid addon in 2017 is just plain reprehensible. HTTPS should be the bare minimum for all connections in 2017, with HTTP fallback if requested. That should be the paid add-on. I really don't see how this is such an unreasonable sentiment that it deserves maximum downvotes.
As others have said though they aren't holding out on basic security. They are holding out on custom domains with security. They provide SSL for free if you don't use a custom domain. It's unreasonable because they provide what you are asking for at a free price point and you're complaining "Not enough!".
You're right. Holes in basic SSL stuff, custom domain or otherwise, leading to insecure defaults are "not enough".
People need to really start demanding more from their hosting providers. Then again, this is the Heroku that sent Rap Genius on a months long troubleshooting spree and tens of thousands in expense due to poor documentation, so perhaps I should just mentally file them in the same bucket as Godaddy and be done with it.
Re: Announcing Free and Automated SSL Certs
#18Free SSL.. for all paid dynos. Apparently, if you're developing an application, you are expected to be okay with having your stuff MITMed. Yes, this is me being excessively negative. Not having SSL-by-default in 2017 is excessively stupid. The certs are free, the system fully automated from both sides. Why hold back? There is no excuse for not having it system wide. Unencrypted HTTP needs to start being treated as th…
Free dynos with a ____.herokuapp.com domain have SSL enabled by default, at no cost (under their wildcard certificate?). Seems the only missing case is when using a custom domain with a free dyno.
It's an obvious missing case, and one that they are clearly conscious of given the constant insertion of the word "paid" in front of "dyno" throughout this announcement post.
The mentality of holding out SSL as a paid addon needs to end. It needed to end years ago. It had no excuse to not end the moment LetsEncrypt went live.
Re: Announcing Free and Automated SSL Certs
#19Sweet, this is basically want Lets Encrypt wanted, make the market go towards this free SSL model.
Companies who aren't in the business of selling TLS [0] certs themselves have little excuse to not offer free TLS via Let's Encrypt. It's an advantage over any competitors who haven't set that process up.
If your company does hosting - your company should provide TLS certs via Let's Encrypt automatically.
[0] Can we start dropping the SSL part now? Generally SSL v2/v3 is disabled so it is all over TLS anyway.
Re: Announcing Free and Automated SSL Certs
#20Earlier quoted context omitted.
As others have said though they aren't holding out on basic security. They are holding out on custom domains with security. They provide SSL for free if you don't use a custom domain. It's unreasonable because they provide what you are asking for at a free price point and you're complaining "Not enough!".
You're right. Holes in basic SSL stuff, custom domain or otherwise, leading to insecure defaults are "not enough". People need to really start demanding more from their hosting providers. Then again, this is the Heroku that sent Rap Genius on a months long troubleshooting spree and tens of thousands in expense due to poor documentation, so perhaps I should just mentally file them in the same bucket as Godaddy and be…
Given your apparent unwillingness to pay for any of their services anyhow I'm guessing this mental filing will only serve to save them money.