Heroku: DNS & SSL - certificate not working. What are the correct DNS / SSL settings?

Question

I have a heroku app that should be reachable via http://www.gewerbeverzeichnis-rj.ch

http://www.gewerbeverzeichnis-rj.ch should always be forwarded to the www subdomain.

I have a GeoTrust QuickSSL-Cert for http://www.gewerbeverzeichnis-rj.ch already on heroku.

These are my cert settings:

     $ heroku certs:info
Fetching SSL Endpoint toyama-4181.herokussl.com info for gwvz... done
Certificate details:
Common Name(s): gewerbeverzeichnis-rj.ch
                www.gewerbeverzeichnis-rj.ch

Expires At:     2015-01-30 12:33 UTC
Issuer:         /serialNumber=RnbwGOxjP0RwwLrQg3bvLgnO151VL0E9/OU=GT63736657/OU=See www.geotrust.com/resources/cps (c)14/OU=Domain     Control Validated - QuickSSL(R) Premium/CN=www.gewerbeverzeichnis-rj.ch
Starts At:      2014-01-28 07:26 UTC
Subject:        /serialNumber=RnbwGOxjP0RwwLrQg3bvLgnO151VL0E9/OU=GT63736657/OU=See www.geotrust.com/resources/cps (c)14/OU=Domain     Control Validated - QuickSSL(R) Premium/CN=www.gewerbeverzeichnis-rj.ch
SSL certificate is verified by a root authority.

And here are my DNS settings on Zerigo DNS:

Screenshot on Dropbox

2 questions:

• Why is my root domain not forwarded to the www subdomain?

• Why is the certificate test on https://ssltools.geotrust.com/checker/views/certCheck.jsp failing?

Any help much appreciated, been stuck here for a while!

Answer 1

Your CNAME entry should be to the SSL endpoint NOT to your Heroku application.

www.gewerbeverzeichnis-rj.ch  CNAME  toyama-4181.herokussl.com

That will stop the SSL error message rather than trying to use the wildcard *.herokuapp.com certificate that it is using when you CNAME to .herokuapp.com

This particular setup step is at https://devcenter.heroku.com/articles/ssl-endpoint#dns-and-domain-configuration

Answer 2

The site seems to be loading a certificate issued by digicert to *.herokuapp.com which means that your heroku app is not correctly configured to use the certificate you have uploaded.