Cloudflare + Vercel + Heroku: Mulitilevel Domains with SSL

Hey everyone!

I am hosting my website on Vercel.com and the web application on Heroku. The web application allows for dynamic subdomains per client. I also have a staging environment on Heroku for the web application. My goal is to get the following working all with SSL configured appropriately.

Vercel

example.com
www.example.com

Heroku

sub1.example.com -> (prod, sub1)
sub2.example.com -> (prod, sub2)
sub1.staging.example.com -> (staging, sub1)
sub2.staging.example.com -> (staging, sub2)

As long as everything has a valid certificate at the origin, the rest is pretty straightforward.
ta
The first two are easy, as that’s covered by Cloudflare’s Universal SSL.

The second two will require Advanced Certificate Manager because of this:

2 Likes

@sdayman I have upgraded my account and created 2 certificates that I believe should work. I think point my *.example.com to my herokudns.com for production and *.staging.example.com to herokudns.com for staging. With that, I get SSL_ERROR_UNRECOGNIZED_NAME_ALERT.

Here is my DNS config.

I see two problems:

  1. That SSL_ERROR_UNRECOGNIZED_NAME_ALERT message means there’s an invalid certificate.
  2. As you can tell from your DNS records, you can’t :orange: Proxy a * wildcard DNS entry (unless you’re on an Enterprise plan). So ACM doesn’t apply. With that in mind, the connection goes directly to the origin, bringing us back to this:

(see Point #1 above)

Ah! Ok, so what I need to do is either upgrade or generate a wildcard certificate and upload to Heroku?

That’s one thing you’ll have to do.

And if you want to proxy that site with Cloudflare, you’ll have to add specific DNS records, rather than wildcards.

Ok, well our clients will be able to choose their own subdomain so I suppose it won’t be possible to do that. Let me give the cert upload a try and see if it meets our needs. Thank you!

1 Like

You’d have to implement some sort of routine to add their subdomain to your DNS via the API:

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.