# SSL on Discourse / DO sub-domain of Heroku hosted domain **URL:** \ **Category:** Self-hosting\ **Created:** [2015年三月15日 20:31 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373 "2015-03-15T20:31:54Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![DKH](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@DKH](https://meta.discourse.org/u/DKH)\ **Post date:** [2015年三月15日 20:31 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/1 "2015-03-15T20:31:54Z")
Expedited SSL, a Heroku ‘add-on’, offers SSL on a sub-domain as well as on the primary domain. It would be nice to hand all the configuration / maintenance off to them. Our sub-domain is a [Discourse.org](http://Discourse.org) instance hosted on Digital Ocean and maintained by the Discourse team. Since the Discourse team also offers SSL as an add-on, I’m looking for guidance (a) regarding feasibility. Would the Expedited SSL have access to our Docker instance / subdomain? (b) Will we also need to purchase an SSL certificate from Discourse. And (c) potential conflicts. Alternatively, should I simply purchase Expedited SSL for the Heroku hosted primary domain and a Discourse team SSL certificate for the sub-domain. (And sort out the configuration myself.) Thanks ---
**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\ **Post date:** [2015年三月15日 20:36 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/2 "2015-03-15T20:36:59Z")
Since you’re using a Digital Ocean docker install, you’ll want to: - Get a certificate+key pair - Follow this guide: > [@Allow SSL / HTTPS for your Discourse Docker setup](https://meta.discourse.org/t/allowing-ssl-for-your-discourse-docker-setup/13847): > > This guide is likely out of date as there are now very few reasons not to use the built-in Let’s Encrypt certificate that Just Works. See also: 2023-04-10 @pfaffman says: This is left here mostly for historical purposes. So you’d like to enable SSL for your Docker-based Discourse setup? Let’s do it! This guide assumes you used all the [standard install](https://meta.discourse.org/t/142537?silent=true) defaults – a container configuration file at/var/discourse/containers/app.yml and Discourse docker is installed at: /var/discourse Buy a SS… ---
**Author:** ![DKH](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@DKH](https://meta.discourse.org/u/DKH)\ **Post date:** [2015年三月15日 20:45 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/3 "2015-03-15T20:45:33Z")
Kane - Thanks; however, I’m trying to avoid that ‘learning curve.’ My Discourse instance was set-up and is maintained by your team (the $100 / month plan). I’m also using Cloudflare which now offers Universal SSL for free. I’m not sufficiently experienced to understand how the pieces fit together. I’m just trying to (a) follow best practices and (b) add Oauth for SSO. Thanks. ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2015年三月15日 20:54 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/4 "2015-03-15T20:54:41Z")
I am not following @DKH. Are you basically trying to cut the SSL cost here? You can proxy discourse but there are concerns and complex configurations you need to follow, I would not recommend it. If you insist see: > [@Full site CDN acceleration for Discourse](https://meta.discourse.org/t/full-site-cdn-acceleration-for-discourse/21467): > > [Fastly](http://www.fastly.com/) , [CloudFlare](https://www.cloudflare.com) and a few other CDNs offer a mode where they accelerate dynamic content. In a nutshell you point your domain IP address at the CDN and the CDN will intelligently decide how to deal with the request. Static content can be easily served from cache Dynamic content can be routed to the site. This provides some advantages over only shipping static assets which is covered in [the CDN howto](https://meta.discourse.org/t/enable-a-cdn-for-your-discourse/14857). You can elect for “[shielding](http://www.fastly.com/products/origin-shield/)” that protects your site from traffic spikes. Dynamic cont… ---
**Author:** ![DKH](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@DKH](https://meta.discourse.org/u/DKH)\ **Post date:** [2015年三月15日 22:51 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/5 "2015-03-15T22:51:10Z")
@sam , cost isn’t the issue. Complexity is. I’m a relatively new developer. Expedited SSL offers to handle everything after initial set-up, including sub-domains and SSL certificate rotation (as a Heroku ‘add-on’). You - [Discourse.org](http://Discourse.org) - also offer SSL and so, too, does Cloudflare. I’m trying to determine the best way forward. My priority is ‘delegation’, not cost. Thanks ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2015年三月15日 22:55 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/6 "2015-03-15T22:55:28Z")
If you want SSL, and are already hosted with us, best way forward is to purchase a cert and have us take care of it. We then take on dealing with all the annoying config issues. ---
**Author:** ![DKH](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@DKH](https://meta.discourse.org/u/DKH)\ **Post date:** [2015年三月15日 23:00 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/7 "2015-03-15T23:00:53Z")
@sam And let Expedited SSL handle the Heroku side of it, i.e., our primary domain? ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2015年三月15日 23:07 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/8 "2015-03-15T23:07:01Z")
I don’t understand why you would use Heroku for SSL this is **very confusing** Just use namecheap or something like that [https://www.namecheap.com/security/ssl-certificates/single-domain.aspx](https://www.namecheap.com/security/ssl-certificates/single-domain.aspx) ---
**Author:** ![DKH](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@DKH](https://meta.discourse.org/u/DKH)\ **Post date:** [2015年三月15日 23:51 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/9 "2015-03-15T23:51:44Z")
@sam - [Expedited SSL](https://www.expeditedssl.com/) through [Heroku as an add-on.](https://addons.heroku.com/expeditedssl?utm_campaign=category&utm_medium=dashboard&utm_source=addons) We’re (eventually) going to be getting personal information on the primary website and taking payments. I’m risk-averse and want someone with experience managing this. ---
**Author:** ![elberet](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elberet/32/122404_2.png) [@elberet](https://meta.discourse.org/u/elberet)\ **Post date:** [2015年三月16日 00:16 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/10 "2015-03-16T00:16:22Z")
Having read through the article about Expedited SSL, this is most likely not what you want _at all_. The intention of the addon is to set up your Heroku-hosted application for SSL, it’s not a generic tool to build valid certificates. In fact, the article mentions that if the addon is removed, the SSL certificate is erased, which leads me to the interpretation that you never get access to the certificate’s private key – transferring this certificate to a non-Heroku server, such as your Digital Ocean droplet, would be flat out impossible. ---
**Author:** ![DKH](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@DKH](https://meta.discourse.org/u/DKH)\ **Post date:** [2015年三月16日 00:48 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/11 "2015-03-16T00:48:35Z")
(a) That’s why I’m asking lots of questions. (b) I understand that, in general, each server needs its own certificate. It’s not clear (yet) if Expedited SSL covers sub-domains hosted elsewhere than Heroku. I have an open support ticket on Heroku. And, (c) based upon the replies ‘to date’, I expect to purchase a certificate for the Discourse sub-domain (from [Discourse.org](http://Discourse.org)) and the Heroku primary domain (from Expedited SSL). I’m trying to avoid managing SSL certificates myself. ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2015年三月16日 01:04 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/12 "2015-03-16T01:04:50Z")
> [@DKH](#): > > I expect to purchase a certificate for the Discourse sub-domain (from [Discourse.org](http://Discourse.org)) We do not sell SSL certificates, you must purchase it from a third party. I strongly recommend you contract somebody technical to help you out here as many of the questions are very confused. As long as you have the ability to validate the CSR we send you we do not care who your SSL provider is. > **[What is a CSR (Certificate Signing Request)?](https://www.sslshopper.com/what-is-a-csr-certificate-signing-request.html)** > > Learn about what a CSR is and how you can generate a Certificate Signing Request to order an SSL certificate. ---
**Author:** ![DKH](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@DKH](https://meta.discourse.org/u/DKH)\ **Post date:** [2015年三月16日 01:21 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/13 "2015-03-16T01:21:32Z")
@sam What does this - below / copied from the $100 / month plan - buy then? SSL Option For an additional $20/month, your site can be available over a secure HTTPS connection, and we’ll double the number of Staff users, too! ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2015年三月16日 01:25 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/14 "2015-03-16T01:25:57Z")
It means we configure SSL certs for you on our server, 1. We send you a CSR 2. You sign it and send us back a file 3. We configure our servers. If this is too hard as long if you provide us admin web accounts for the SSL provider you choose we can take care of step #1 and #2 and #3. ---
**Author:** ![DKH](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@DKH](https://meta.discourse.org/u/DKH)\ **Post date:** [2015年三月16日 17:19 UTC](https://meta.discourse.org/t/ssl-on-discourse-do-sub-domain-of-heroku-hosted-domain/26373/15 "2015-03-16T17:19:30Z")
@sam Here’s Expedited SSL’s reply to the initial question I asked both of you: > There’s nothing special about a certificate that ties it to just a single host - but in order to accomplish what you’re looking for here, you’d need to purchase our wildcard plan ($79/mo) - and we’d then export the cert for you to manually install on Digital Ocean or wherever else you might need it. > > That being the case I think you’d be much better off just using our single plan and then getting a separate certificate from Discourse for your forum. Now I know what to do: Expedited SSL on the primary website, purchase a separate certificate per your recommendation for my ‘community.’ Thanks, Doug