Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Heroku offers the option to use Hostname based SSL. Apparently this is a solution which they use to offer multiple SSL hostnames on the same IP address, without using SNI (which doesn't work on Windows XP).

From the website:

Hostname based SSL works with all browsers. Use it when you will be accessing you site via SSL on a subdomain such as www.myapp.com, secure.myapp.com or *.myapp.com. Hostname based SSL will not work with root domains as it relies on CNAME aliasing of your custom domain names. CNAME aliasing of root domains is an RFC violation.

So how exactly does this work? Does it mean that they request you to add a CNAME alias to your domain and then issue a certificate for the CNAME (e.g. www.mydomain.com -> secure.heroku.com, upon visiting www.mydomain.com, a certificate for secure.heroku.com is presented). Does such a thing work? If it does not do that, then what does it do?

share|improve this question

closed as off topic by random Aug 28 '11 at 21:16

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
In SSL, CNAMEs are never checked - only the hostname entered by user is considered. –  grawity Dec 20 '10 at 16:21

1 Answer 1

We have done a writeup on how to do this here:

http://blog.dynamic50.com/2011/02/15/ssl-on-wildcard-domains-on-heroku-using-godaddy/

share|improve this answer
1  
-1 The question is not about how to set this up (which is well enough explained in heroku documentation). The question about what's the technology behind this solution. Aside from that - the question belongs to serverfault. –  mdrozdziel Jun 29 '11 at 20:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.