7/10/210
It took me several tries to get an SSL Certificate from GoDaddy to work on Heroku without scary warnings in IE or Firefox. I do not suggest using GoDaddy for anything. I only used it in this case as my client was using it. But I figure other people are in the same boat so hopefully this post can help out a few of you.
Contents
Further Reading - Heroku’s SSL Doc
Generate RSA Key and Certificate Signing Request (Tested on OS X 10.6, should work on any system with openssl)
openssl req -new -newkey rsa:2048 -nodes -out www.yourdomain.com.csr -keyout www.yourdomain.com.key
Ensure the common name is the domain and subdomain you want SSL on. (Example: www.yourdomain.com) and keep the password blank. Fill out the rest as it requests, it’s fine to leave things like the email blank.
Further reading - https://www.digicert.com/easy-csr/openssl.htm
Purchase and Download SSl Certificate from GoDaddy
Go here and follow through their checkout process http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=8979
After that you have to go here https://mya.godaddy.com/Products/AccountList.aspx?ci=9038&Product=ssl and use the credit you just bought.
And then into here https://certs.godaddy.com/ccp/home.seam?cid=28267 to actually use the credit you just bought! GoDaddy has worked hard to make this process very confusing and hide the links to each part.
From here click “Request Certificate”, and paste in the Certificate Signing Request we generated early. You can print it out to terminal with
cat www.yourdomain.com.csr
Make sure you are requesting the specific subdomain you want the SSL for (normally you will want “www.yourdomain.com”).
Walk through their steps, once complete download your certificate for server type “other”. Unzip the files and move them into the same folder as the key we generated.
Combine the Certificate with the chain/intermediate certificate
GoDaddy gives you the Certificate and chain/intermediate certificate separately, we need to combine these before uploading to Heroku.
cat www.yourdomain.com.crt gd_bundle.crt > combined_www.yourdomain.com.pem
Setup and Upload to Heroku
Add the Host Based SSL to your application on Heroku. This one only costs $20 a month and displays no warnings on major browsers. Unfortunately you have to be using a subdomain, so while www.yourdomain.com will work, yourdomain.com won’t.
To add this type
heroku addons:add ssl:hostname
And then be sure to change your DNS for the subdomain to point the the address Heroku emails you.
Ensure your certificate ends in .pem or IE7 (and I think IE8) will display the “There is a problem with this website’s security certificate.” warning.
From the folder with the keys
heroku ssl:add combined_www.yourdomain.com.pem www.yourdomain.com.key
Test!
Very important: Check to make sure SSL is working without warnings on every browser you plan to support. The warnings that browsers give out when they are unhappy with https page is very scary to users and results in lose of sales and confidence in your site.
Hope this helped you out!
-Eric Cranston