I have an SSL wildcard for my rails site through DNSimple, and have deployed to Heroku.
I have smoothly functioning full-site SSL for all subdomains of my site, except for when I enter my site name without a subdomain into a browser for the first time.
Although my Heroku settings redirects http://mysite.com to https://www.mysite.com, the browser pops up a security warning first, because the SSL certificate for *mysite.com requires a subdomain.
Is there a way to redirect from no subdomain to with subdomain before checking for the security certificate?
This is a substantial issue, as it's unreasonable to require/expect first time visitors to type in www before the site name.
you can use subdomain redirection: https://devcenter.heroku.com/articles/avoiding-naked-domains-dns-arecords#subdomain-redirection
but I think only with the www form, as it warns:
Requests made directly to naked domains via SSL (i.e.
https://mydomain.com) will encounter a warning when using subdomain
redirection. This is expected and can be avoided by only circulating
and publicizing the subdomain format of your secure URL.
Related
I have my site and the hosting was on GoDaddy and I changed it to CloudFlare .. Previously, you could access the Via site just writing example.com or www.example.com
But after changed the Hosting, the site does not open and you must enter www
By saying you changed your site from Godaddy hosting to Cloudflare, what do you mean?
Plus, there are a few possible cases in which this could happen.
The SSL Certificate configuration you have active on the site. I do not mean Cloudflare Native certificate (This might not be a reason that would occur always)
Your .htaccess configuration (There should be something that is redirecting your site)
Kindly check these and see if it helps
I've got a site that was originally running on a non-heroku server that I moved to heroku. The site was using a bare domain before (example.com). Heroku requires non-bare domains (www.example.com) as per this article: https://devcenter.heroku.com/articles/apex-domains
My question is: I have a bunch of links out there currently like this: https://example.com which throw a browser error now that I am using non-bare domains.
This excerpt from heroku confirms the error is widespread.
SSL
Traffic routed over SSL behaves, at the DNS level, identical to unencrypted traffic and suffers from the same naked domain limitations.
However, applications requiring SSL encryption should use the ALIAS/ANAME configuration on the root domain. Subdomain redirection will cause a browser error when the root domain is requested over SSL (i.e. https://example.com).
How can I redirect people to the right domain without them experiencing a browser error?
EDIT:
I emailed heroku and this was their response:
I'm afraid only the ALIAS/ANAME style records will be able to reference an SSL endpoint at the apex and from my understanding Namecheap do not support those record types. We have a few examples for various providers here. But if your domain provider doesn't support ALIAS/ANAME we can only recommend you switch to another provider that does. A URL redirector doesn't work for SSL, the CNAME type breaks email, and raw A records can break after only a few minutes.
So I moved providers from Namecheap to Cloudflare, CNAME'd instead of redirected, and everything now works as expected.
If you don't have an SSL endpoint provisioned then your visitors will get a 'certificate mismatch' error as Heroku will serve their default herokuapp.com certificate. You can't redirect https without a valid certificate as browsers first check the validity of the certificate. If you're moving to Heroku and want to respond to those requests you will need a valid certificate, SSL endpoint provisioned and a DNS provider that supports using CNAMEs on Apex records.
I uploaded my Rails application to Heroku, bought a domain name mysite.com on Site5 and pointed it to my Heroku application URL. I can normally access my site on Heroku when I type www.mysite.com and everything works.
The problem is that before my site opens, I receive a warning that the certificate for this website is invalid and that some other site is pretending to be my site. This looks bad if a customer comes to my site and sees that warning and needs to accept their information "will be at risk". How can I avoid this message?
Here is the screenshot how it looks in Safari:
Heroku provides a wildcard SSL certificate covering all herokuapp.com subdomains. This will only be valid, of course, when accessing your app via its herokuapp.com subdomain.
If you need SSL for your custom domain, you need to acquire your own certificate for that domain and pay Heroku ($20/mo) to use that certificate for your application.
If you don't need SSL, verify your code isn't redirecting HTTP to HTTPS requests. This isn't something Heroku normally does by itself; any forced-secure transit is most likely coming from your application.
See Heroku KB: SSL Endpoint
I've deployed my app on to a Ubuntu VPS using Capistrano, nginx/
Passenger and a wildcard SSL certificate.
The app works fine on development and my staging environment on
Heroku.
However, there are two problems on production when users sign into the
site using a secure page.
On latest Chrome and Firefox the browsers start to enforce HTTPS
requests on every single request every time. Regardless if the user is
signed in or not. Even if I disable SSL on nginx the browser still attempts HTTPS and complains it cannot connect. The main page serves some insecure dynamic embedded
items and uses an insecure CDN so I would like to serve that page as non-
SSL. Whenever I tried to redirect a page to non-SSL either through
nginx rewrite or a before filter in Rails it will cause an infinite
redirect loop.
Safari does not have the first problem as above it respects both
HTTPS and HTTP requests. However, when the user has logged in and
browses to a non-SSL page they are signed out or lose the session
instantly.
Has anyone encountered such a problem before or have an idea on how I could diagnose/fix the problem?
Thanks
Were you using Rails 3.1 force_ssl to enable SSL, or a gem?
When you enabled HTTPS, you also enabled the the HTTP Strict Transport Security flag, which the browse uses to immediately go to any HTTPS page on that domain before it sends the request to the server.
On Chrome, enter chrome://net-internals/#hsts into your browser and then you can delete your domain from the HSTS list which should fix it for Chrome. Can't speak for Firefox as I don't use it that often.
The issue with it losing session is likely because Rails is setting the authentication cookie as secure which means they are only sent for HTTPS requests and not HTTP. Make sure your cookie_options in Rails are not setting :secure => true. Also check the Devise cookie_options setting to ensure that :secure => true isn't being set.
I am using a SSL cert for www.mydomain.com from GoDaddy on Heroku. How can I redirect from the root url, https: //mydomain.com to https: //www.mydomain.com from within rails so my cert will work? I have been able to redirect all other combination with custom middleware, so that SSL is always serverd, but can't figure out how to do this without the browser detecting the lack of a cert for https://mydomain.com/. Is there something like a rack env[HOST] that I can rewrite? Thanks in advance....
The browser compares the cert to the domain name way before Rails even gets a chance to touch it - in fact, it's the very first part of the negotiation with the server, so you can't even use Apache Rewrite to change it.
What you should do is add mydomain.com to your cert. They're called "unified communications" certificate, although GoDaddy just calls them a Multiple Domain cert. http://help.godaddy.com/article/3908