How do you install a LetsEncrypt SSL Certificate on Heroku

Question

Since Heroku is read-only and does not allow sudo, what do I need to do to be able to install the LetsEncrypt.org certificate on their server for my app?

If I have already set config.force_ssl = true does that matter?

Answer 1

I read the blog post in the first answer here, but I didn't want to pollute my code-base with ACME urls & logic. So I did something similar, but used DNS domain validation ...

With certbot, specify DNS as your preferred challenge:

sudo certbot certonly --manual --preferred-challenges dns

After a couple of prompts, certbot will tell you to deply a DNS TXT record to validate your domain:

Please deploy a DNS TXT record under the name
_acme-challenge.www.codesy.io with the following value:

CxYdvM...5WvXR0

Once this is deployed,
Press ENTER to continue

Your domain registrar probably has its own docs for deploying a TXT record. Do that, and go back to certbot and press ENTER - Let's Encrypt will check the TXT record, sign the cert, and certbot will save it for you to upload to heroku.

See my own blog post for more detail.

---

Here are two bash functions that you can use to automate the process for you

function makessl {
    sudo certbot certonly --manual --rsa-key-size 4096 --preferred-challenges dns -d ${1}
    sudo heroku certs:add --type=sni /etc/letsencrypt/live/${1}/fullchain.pem /etc/letsencrypt/live/${1}/privkey.pem
}

function renewssl {
    sudo certbot certonly --manual --rsa-key-size 4096 --preferred-challenges dns -d ${1}
    sudo heroku certs:update /etc/letsencrypt/live/${1}/fullchain.pem /etc/letsencrypt/live/${1}/privkey.pem
}

They take an arguement for the domain name and as long as you run them from within your heroku app folder you will not have to specify an --app NAME

Example: makessl www.domain.com

Example: renewssl www.domain.com

---

Combine this is @Eric's answer and you're good to go:

heroku certs:auto:enable