letsencrypt-rails-heroku icon indicating copy to clipboard operation
letsencrypt-rails-heroku copied to clipboard

Published 20 hours ago • verified publisher icon pixielabs

If auto-detecting domains to verify, skip .herokuapp.com domain

Open jalada opened this issue 8 years ago • 1 comments

It's pointless to verify it because Heroku will always use their own certificate, and it is a slight information leak to expose the name of the Heroku app in the certificate.

jalada avatar Feb 28 '17 15:02 jalada

This caught me out today; if you have only the herokuapp.com domain in the certificate, Heroku gives you a lousy 403 with no explanation when you try and upload the certificate.

jalada avatar Oct 07 '20 11:10 jalada