heroku: set SSL certificates on Free Plan?

Question

I would like to set some SSL certificates for one app I have on heroku (a simple application based on nodeJS + Vue).

I know if I upgrade to the Hobby Plan (7$ for month) I can have it automatically.

But for now it would too much money for a test application, so I am wondering if I can achieve some similar goal also with a Free Plan.

so: Is it possible to set SSL certificate for an app on Heroku JUST with the Free Plan? Maybe in a complicated/tricky way via CLI?

From the Heroku pages and documentation it looks not possible. But I have to ask :)

Solution 1

Here I have a better approach to deal with this. As Heroku Doesn't provide SSL for Free Plan. But You can use Cloudflare which gives free SSL. You can Use Cloudflare As Bridge For SSL.

Requirement:

1. Cloudflare Account
2. Your Application should not have inbuild SSL redirection (like redirect-ssl) Otherwise, This will result in Too Many Redirect Error

Step 1: Point Your domain to CloudFlare. You basically open an account an enter your domain when prompted. You may be given instructions to change your domain name servers.

Step 2: Add Cname Record of Heroku Server in DNS of Cloudflare. Instructions are here Here You will get Some SSL Security Issue.

Step 3: Now Change Your SSL/TLS encryption mode to Flexible (Not Full). *Important

Now Understand the Working:-

Client(Browser) Make Request to https://example.com First, the request reaches the Cloudflare with SSL. (User see encrypted connection to the server.)

Then Cloudflare makes request to Heroku Server(Origin) with Non-SSL (Non-Https and Unencrypted).

Then Heroku Server (Origin) returns the Response with Non-SSL to Cloudflare.

At the end Cloudflare forward the request to Client (Browser.)

---

You might think, What is the benefit of just encrypting half system. but "Something is better then nothing".

You are here because you don't want to spent money on heroku paid dynos.

This method is better for those who is using http. Atleast it protects the most vulnerable side (client side). Where most of the attack happen. There is very less chances of attack between cloudflare and your server. Because of network reach.

Having less vulnerable probability is better then 100% vulnerable system

---

I have tested this method and working on https://www.auedbaki.com

Solution 2

Late response but I'm adding here I just spent an hour trying to setup SSL with Heroku - resulting in a dead end.

The bottom line is that Heroku mentions they offer free SSL certificates but that's really not the case unless you have a Hobby ($7/mo) or Pro plan.

This link has more details and feedback from other users facing the same issue.

The answer above about LetsEncrypt is incorrect. Although you can get a free certificate, it cannot be included in a free Heroku app.

Other users have pointed to this article with a step-by-step guide but the guide is outdated and the 'Labs' option mentioned does not work with Heroku anymore.

see comments below for some alternative suggestions

In my specific case, I was able to get a free SSL on zeit.

Solution 3

Here's how you get FULL SSL using Cloudflare for FREE.

Step 1: Point Your domain to CloudFlare. You basically open an account an enter your domain when prompted. You may be given instructions to change your domain name servers.

Step 2: Add Cname Record of Heroku Server in DNS of Cloudflare. Instructions are here. Here You will get Some SSL Security Issue.

Step 3: Now Change Your SSL/TLS encryption mode to Full

Step 4: In your DNS settings, you’ll want to create a CNAME: yourdomain.com -> yourapp.herokuapp.com.

(I learned about the general approach here https://mikecoutermarsh.com/adding-ssl-to-heroku-with-cloudflare/ Although it's old, it still works.

Solution 4

I had this issue also. I wanted to set up a custom domain for my free account on Heroku for my React App. I searched so much info on the web and read loads of documents from Heroku support.

The conclusion is that on the Heroku free account, a custom domain name with SSL certificate cannot be setup. If you need SSL with your custom domain name, you need to upgrade to any of their paid hosting accounts.

Heroku does provide SSL certificate for their free account as long as it is not using a custom domain name. So the standard free account URL will be something like this "https://your-app-name.herokuapp.com"

NB. Google Firebase allows free hosting and Custom Domain name with SSL, for up to a certain amount of traffic before charging. For testing an app, this will be a perfect alternative. I am using it. And it was easy to set up my custom domain.

I hope this saves you hours of searching.

Solution 5

Since you don't make explicit if you need to apply the SSL certificate to a custom domain, I think it's necessary to say that according to the Heroku documentation:

Apps using free dynos can use the *.herokuapp.com certificate if they need SSL.

https://devcenter.heroku.com/articles/ssl

Maybe future readers could find this answer helpful...

View more solutions

Comments

[stellavalerio]

Thanks alphazeta for the answer. I've also arrived to the same conclusion in these months: not possible. Sad but true. But I re-arranged my project as static page with some services and now I don't need Heroku anymore. Lesson learned :)

[alphazeta]

What service you ended up using? Let me know so I can include in the answer above as a suggestion for future reference.

[stellavalerio]

Well I changed completely my stack. my main app is now a static website, hosted on Zeit now (zeit.co). Here I can have free SSL and a custom domain. So SSL issue solved. For the server features I need it (a contact form), now my static website use another node app, hosted on Heroku, via ajax.

[Keith Bennett]

I believe you need to be using Cloudflare's DNS for this to work, but it's quite easy to use, and they support CNAME flattening so you can point your root domain to the Heroku site with a CNAME. This worked great for me, thanks!

[Yashdeep Raj]

@Ungapps Website is working. It may possible that, Website goes on sleep when no traffic. So it takes times to response.

[Ungapps]

For better result, set "Always Use HTTPS" in Edge Certificates tab. You can SSL with subdomain too.

[michcio1234]

Why would you want to encrypt only a half of request's route to the server? So that your users see a green lock in their browser and think that your site is secure? Not cool...

[Yashdeep Raj]

@michio1234 It is better then having unsecure warning in the browser. We know this is not good practice at all. But this the only way to get free ssl without spending a single penny.

[WhyNotHugo]

This requires reducing lowering the security on the whole domain (disabling HSTS), and will result in traffic in plain text. Don't do this.

[cikatomo]

how to adjust www redirect?

[ThinQtv]

I tried this, but then Namecheap disabled all my email forwarding and I even though I could Sign Up on my site, I was no longer able to sign in.

[Yashdeep Raj]

@ThinQtv It's not NameCheap who disabled your email forwarding. I think you forgot/miss some mx records to copy on CloudFlare. Because after using CloudFlare NameServer no DNS Setting will work from NameCheap. You should move all settings to CloudFlare.

[J0ANMM]

Apparently Vercel.com acquired Zeit. I was not able to find any SSL service in Vercel.com

[ThinQtv]

@auedbaki Yeah, it was NameCheap that disabled email forwarding. According to namecheap, "Our free email forwarding option is available on our default BasicDNS (or PremiumDNS, FreeDNS) nameservers. If nameservers are switched to Cloudflare's one, the option will be inactive for the domain."

[Pat]

Sadly (NEW): "When an app is migrated to the new infrastructure, its default appname.herokuapp.com, DNS records, and any haiku.herokudns.com custom domain records are modified to point to the IP addresses of the new routing infrastructure. For a period of 24-48 hours, the app is accessible via both the new and old routing infrastructure. When the migration completes, the app will no longer be accessible via the old routing infrastructure and all traffic must flow via the new infrastructure. Requests for an app sent to the old infrastructure will result in error code: H31 Misdirected Request."

[Coder Gautam YT]

Getting err ssl version or cipher mismatch

[michcio1234]

This makes much more sense than the top-voted answer. My only concern is - is it safe to let CloudFlare see the unencrypted user's data?

[michcio1234]

@ThinQtv I think you're still missing the point. You can use either NameCheap DNS or CloudFlare DNS. Since you switched from Namecheap to CloudFlare, it's no surprise that settings from Namecheap aren't working.