SSL - invalid CN after installing certificate (getting CN *.herokuapp.com)

Question

I have a heroku app hosted at www.example.com.

I have a certificate issued for that address (www.example.com). I've installed the certificate successfully according to the heroku docs.

However, I how have a problem:

• when I visit www.example.com, I get an invalid CN error (says that it is issued for *.herokuapp.com)
• when I visit example.herokuapp.com, I also get an invalid CN error (this time the cert CN is for www.example.com)

So the certificates are pretty much flipped. This is still pretty fresh (<1 hour) - could waiting solve the problem?

Also: This part of the heroku docs shows an endpoint in the form example.herokussl.com

$ heroku certs:info
Fetching SSL Endpoint example-2121.herokussl.com info for example... done

And I'm getting the standard example.herokuapp.com endpoint, so I did not have to change the DNS settings after installing the certificate. Could that be some clue?

Answer 1

If you have already configured your domain DNS for non-SSL, standard http:// access, keep in mind that you need to update it again for SSL. From your Heroku account, go to your app settings, Domain section. You will see something like:

In this example, the example.com's DNS should be updated to point to example-ssl.herokussl.com (and not example-standard.herokuapp.com).

Answer 2

Turns out this was a DNS caching issue on my machine. Since this was Linux, changing browsers did not work (also for some reason restarting the dns deamon).

Anyway, it's fine now.