If you're using Heroku for web app hosting, you can leverage Let's Encrypt to generate a free SSL certificate for your Node.js application.
Key Takeaways
- You can obtain free SSL certificates using Let's Encrypt instead of paying third-party providers.
- Configuring SSL with Heroku now leverages SNI, reducing costs compared to older methods.
- This guide walks you through setting up a free SSL certificate with Heroku and Node.js.
Why?
While services like GoDaddy offer SSL certificates, they typically charge around $60 annually. Instead, let's make use of Let's Encrypt to generate SSL certificates for free. Recently, Heroku enhanced its platform to support SSL for any apps using paid dynos, utilizing Server Name Indication (SNI) to provide cost-effective SSL solutions.
Steps
This tutorial assumes you have the Heroku CLI installed and are working with Node.js. Furthermore, it assumes you have a Node.js app already deployed to a paid Heroku dyno (Hobby or better). Although this example uses GoDaddy as the DNS service provider, it's not mandatory to have your domain purchased through GoDaddy. The steps are as follows:
- 1. Configure Heroku
- 2. Configure your DNS
- 3. Generate free SSL certificate
- 4. Configure your Node.js app
- 5. Upload certificate to Heroku
1. Configure Heroku
First, add your custom domain to your Heroku app. Remember to include CNAMEs for both your root domain (yourappname.com) and the "www" prefixed version (www.yourappname.com).
heroku domains:add yourappname.com
heroku domains:add www.yourappname.com
Verify your setup:
heroku domains --app yourappname
You'll see output similar to this:
=== yourapp Heroku Domain
yourapp.herokuapp.com
=== yourapp Custom Domains
Domain Name DNS Target
──────────────── ──────────────────────────────
yourapp.com yourapp.com.herokudns.com
www.yourapp.com www.yourapp.com.herokudns.com
2. Configure your DNS provider
In your DNS management console, point the CNAME alias for "www" to the DNS target specified above. For instance, you would set your CNAME www alias to www.yourapp.com.herokudns.com.
Ensure domain forwarding is enabled so that users are directed to the secure version of your site (e.g., https://www.yourapp.com) regardless of how they enter the URL.
3. Generate free SSL certificate
Homebrew and Certbot simplify the process of obtaining SSL certificates. If Homebrew isn't installed on your system, you'll need it for Certbot:
brew install certbot
With Certbot installed, proceed with:
sudo certbot certonly --manual
Follow the prompts to generate your certificate. You'll need to input your email and custom domains. The process includes steps to create a verification file served from your app domain:
http://your.domain/.well-known/acme-challenge/some-random-characters
some-random-characters.-more-random-characters
The string highlighted in red is crucial—copy it for the next steps. Don’t press ENTER until this is handled.
4. Configure your Node.js app
This example uses Express to create a REST endpoint for SSL token verification:
app.get('/.well-known/acme-challenge/:cert', function(req, res){
var id = req.params.cert;
var finalString = id + 'Key from step 3';
res.setHeader('content-type', 'text/plain');
res.send(finalString);
});
Deploy these changes before testing your SSL setup. Additionally, force https using the express-force-https module:
npm install express-force-https
var secure = require('express-force-https');
app.use(secure);
5. Upload certificate to Heroku
Return to the Certbot client. If step 3 succeeded, you'll have .pem files in: /etc/letsencrypt/live/<your.domain>/. To upload the certificate:
heroku certs:add /etc/letsencrypt/live/<your.domain>/fullchain.pem \
/etc/letsencrypt/live/<your.domain>/privkey.pem --app <your-app>
Conclusion
If everything worked as planned, your custom domain should now have a valid SSL certificate.
FAQ
Do I need to renew Let's Encrypt certificates?
Yes, Let's Encrypt certificates are valid for 90 days. Use tools like Certbot to automate renewal.
Can I use this method for non-Heroku hosted apps?
Yes, you can use Let's Encrypt with other hosting providers. The core steps involve obtaining the certificate and configuring your server to use it.
What if Certbot isn't available for my OS?
If Certbot isn't available, most modern package managers should have alternatives, or you can download it directly from Certbot’s website.
