Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New TLS certificate for .herokuapp.com hostnames

devcenter.heroku.com

Post reply on HN
Print view View original

1–10 of 43 posts

New TLS certificate for .herokuapp.com hostnames

#1

Post by paulfurley »

We run a backend API app on Heroku and for simplicity our frontend calls it via the herokuapp.com subdomain `.herokuapp.com`.

We haven't bothered with a custom domain SSL certificate as the herokuapp.com subdomain has been just fine.

Fortunately I was monitoring the endpoint as I started getting SSL expiry warnings a few weeks ago.

It seems heroku is serving an old certificate for .herokuapp.com, issued April 2019 and expiring 22nd June:

``` $ curl -v --head https://.herokuapp.com/ * Connected to .herokuapp.com (52.19.225.66) port 443 (#0) [snip] * Server certificate: * expire date: Jun 22 12:00:00 2020 GMT * subjectAltName: host ".herokuapp.com" matched cert's ".herokuapp.com" issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA ```

It's a wildcard cert for .herokuapp.com but it's different from the current one I see if I curl the root domain:

``` $ curl -v --head https://herokuapp.com/ Connected to herokuapp.com (34.194.84.166) port 443 (#0) * Server certificate: * expire date: Aug 2 02:13:11 2020 GMT * issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3

```

It seems they've transitioned to Let's Encrypt for the wildcard domain, but it isn't being served for app subdomains. I've checked a few other subdomains and see the same thing:

* govuk-prototype-kit.herokuapp.com * heroku-status.herouapp.com * juice-shop.herokuapp.com

I've been raising this with support since T-30 and they just keep saying things like:

> Our concerned team is aware of it and they are actively working on the renewal process. We'll get the new cert in there well before the expiration, and there will be no disruption of service.

Now we're at 7 days I've lost confidence that support has even forwarded my ticket to the right team.

I suspect in 7 days we're gonna see a lot of things break...

New TLS certificate for .herokuapp.com hostnames
devcenter.heroku.com

Re: New TLS certificate for .herokuapp.com hostnames

#3

Post by jamil7 »

Heroku also doesn't enforce any verification that you own a domain name. Another user can simply add any domain they like to their app if you haven't claimed it by adding it to your app first. Regardless of ownership and you will no longer be able to add your own domain to your app getting a generic "domain is already in use" error. Happened to me a few years ago, had to reach out to support and prove I owned the domain. They made me verify I owned it and fixed it but said theres nothing they can do going forward. Granted it's a total edge case but was still an unnexpected experience, maybe it's fixed now who knows.

Edit: Looks like this is fairly common on PAAS so my original comment isn't that relevant.

Re: New TLS certificate for .herokuapp.com hostnames

#4

Post by _raul »

There's more context in this Heroku Changelog https://devcenter.heroku.com/changelog-items/1813

"On Tuesday June 9th 2020 Heroku changed the certificate used for terminating TLS for built-in .herokuapp.com hostnames from a certificate issued by DigiCert to one issued by Starfield/AWS. This change was rolled back on June 10th because a small subset of Heroku customers had pinned apps to the DigiCert certificate or had apps that could not establish a chain of trust with the new certificate for other reasons.

A new DigiCert-signed certificate will replace the current one before June 22nd (when it expires)."

Re: New TLS certificate for .herokuapp.com hostnames

#6

Post by swiley »

jamil7 wrote: post #3

Heroku also doesn't enforce any verification that you own a domain name. Another user can simply add any domain they like to their app if you haven't claimed it by adding it to your app first. Regardless of ownership and you will no longer be able to add your own domain to your app getting a generic "domain is already in use" error. Happened to me a few years ago, had to reach out to support and prove I owned the dom…

How does GitHub’s gh pages handle this? I don’t remember them doing anything either.

Re: New TLS certificate for .herokuapp.com hostnames

#7

Post by PedroBatista »

abhisuri97 wrote: post #2

Wow. I really hope they’ll get it done before the expiration date but I always thought they’d be renewing months in advance at minimum. Are they trying to negotiate something?

Most likely.

I'm pretty sure the money they want is something ridiculous because in their business wisdom they know Heroku has no power if they don't want to rock the boat.

The question is: Is Heroku willing to rock the boat?

Re: New TLS certificate for .herokuapp.com hostnames

#8

Post by derision »

swiley wrote: post #6
jamil7 wrote: post #3

Heroku also doesn't enforce any verification that you own a domain name. Another user can simply add any domain they like to their app if you haven't claimed it by adding it to your app first. Regardless of ownership and you will no longer be able to add your own domain to your app getting a generic "domain is already in use" error. Happened to me a few years ago, had to reach out to support and prove I owned the dom…

How does GitHub’s gh pages handle this? I don’t remember them doing anything either.

Pretty sure you have to set some DNS records for gh pages

Re: New TLS certificate for .herokuapp.com hostnames

#9

Post by londons_explore »

jamil7 wrote: post #3

Heroku also doesn't enforce any verification that you own a domain name. Another user can simply add any domain they like to their app if you haven't claimed it by adding it to your app first. Regardless of ownership and you will no longer be able to add your own domain to your app getting a generic "domain is already in use" error. Happened to me a few years ago, had to reach out to support and prove I owned the dom…

As long as support can fix this, it isn't really a problem is it? If you point your domain to heroku having not set it up first, that's on you...

Re: New TLS certificate for .herokuapp.com hostnames

#10

Post by jamil7 »

swiley wrote: post #6
jamil7 wrote: post #3

Heroku also doesn't enforce any verification that you own a domain name. Another user can simply add any domain they like to their app if you haven't claimed it by adding it to your app first. Regardless of ownership and you will no longer be able to add your own domain to your app getting a generic "domain is already in use" error. Happened to me a few years ago, had to reach out to support and prove I owned the dom…

How does GitHub’s gh pages handle this? I don’t remember them doing anything either.

I actually don't know as I haven't used it in a while. But I did just test netlify and the same issue exists there, domains need to be unique, perhaps there isn't a nice way of dealing with that edge case.
Post reply on HN