Announcing Better SSL for your Heroku App | Hacker News Reader

Announcing Better SSL for your Heroku App

blog.heroku.com

69 pointsbgentry19 comments

"Client IP address is forwarded to application as X-Forwarded-For" is the biggest news here.

Previously, it cost $100 per month to have access to the Client IP over SSL, so any sort of geo-location was out of the question.

Insane prices for arbitrary things are why I left Heroku a few months ago and decided to custom build my servers on Linode.

Isn't this just Heroku copying what cloudflare already has on offer?

This is a standard HTTP Proxy header: https://en.wikipedia.org/wiki/X-Forwarded-For

In fact, the "X" indicates it is not a standard header. But yes, very common for proxies to pass on.

Maybe Heroku can license the technology to Google, since the Google App Engine team has seemingly been unable to launch a similar solution three years after putting it on their roadmap.

Here are the new features...

  - Instant provisioning
  - Client IP address is forwarded to application as X-Forwarded-For
  - Better validation of certificate files
  - Rollback of certificate changes

$20/mo for SSL is crazy.

It's because they have to provision an Elastic Load Balancer to sit in front of your app. That's the only way they can acquire additional IP addresses from AWS.

They make no money on this arrangement, they are simply passing the ELB costs on to you.

ELB endpoints are domain names, not IP addresses. How would ELB help them "acquire additional IP addresses"?

Domains that resolve to an IP... I'm not 100% sure how they are configured behind the scenes, but the ELBs have a bunch of physical IPs wired into them, so they can SSL terminate for many domains, something that EC2 instances cannot (currently) do.

So Heroku leverages the ELBs to circumvent the 1 IP address per EC2 instance issue.

EDIT: more info here http://serverfault.com/questions/285680/what-is-the-technolo...

Unless you use SNI (which is only supported in some browsers) you have to have one IP per SSL host as the certificate is sent before decoding the request. ELB doesn't use that and must have 1 IP per hostname.

Ah, right -- kind of an oh, duh moment for me. Thanks!

Most importantly -- any IE on Windows XP.

I guess this is an opportunity for any PaaSes that aren't built on EC2.

It definitely is, but AWS has made it clear they will be rolling out multiple IPs per EC2 instance this year.

The downsides of not being on EC2 these days are many. You wouldn't be able to offer the fleet of bonus services that Heroku can offer.

Let's see how many people pay it, and then decide whether or not it's crazy.

On Appharbor (The Heroku of the .Net world), SNI Based SSL is $10/m, Hostname based SSL is $50/m, and IP-based SSL is $100/m.

Does this support wildcard SSL certs?

It does!

Reply on news.ycombinator.com