Announcing Better SSL For Your App

SSL is a crucial part of any web app with a login session. As Firesheep demonstrated, HTTPS everywhere is the path forward for modern web apps. Heroku follows this with our own login-protected apps, from the management interface to the Dev Center to the Toolbelt.

Announcing Better SSL For Your App

Today, we're announcing two new features to make it as easy as possible for you to secure your app running on Heroku with SSL.

First, all apps now have piggyback SSL by default. Prepend https to the hostname for any Heroku app (https://yourapp.herokuapp.com for Cedar and https://yourapp.heroku.com for Aspen/Bamboo) and you'll piggyback on the *.herokuapp.com SSL certificate. No special configuration is needed, just access the app with https and you're secure by default.

Then, for apps running on custom domains, we have a new SSL product that unifies and simplifies our SSL add-on lineup: SSL Endpoint.

SSL Endpoint is priced identically to SSL Hostname ($20/mo) but offers these additional benefits:

  • Instant provisioning
  • Client IP address is forwarded to application as X-Forwarded-For
  • Better validation of certificate files
  • Rollback of certificate changes

Try It Out

SSL Endpoint is easy to use: add the add-on to your app, then upload your certificate and private key.

$ heroku addons:add ssl:endpoint
-----> Adding SSL endpoint to myapp... done, v20 ($20/mo)

$ heroku certs:add final.crt site.key
-----> Adding certificate to myapp... done. 
       myapp now served by tokyo-2121.herokussl.com.

You'll get a unique endpoint hostname, such as tokyo-2121.herokussl.com. Create a CNAME record to this hostname for your domain, and you're done.

In setting up SSL for your custom domain you'll still need to purchase an SSL certificate from a provider elsewhere, and configure your DNS. The Dev Center now provides guidance on each of these steps:

SSL Endpoint, like SSL Hostname, will not support naked domains. More detail on issues presented with naked domains can be found here.

Conclusion

With security and privacy as top concerns in this era of digital communication, Heroku wants to make it as easy as possible for your app to be secure and trusted for your users. The internet is increasingly embracing HTTPS everywhere, and HTTPS on Heroku has never been easier.

Heroku's new, free PostgreSQL 9.1 development database

Today Heroku is launching a new version of our free Postgres database service. This new dev plan offers increased parity between our free database service and our paid, production plans. New features include:

This plan is available immediately in public beta and can be provisioned through the Heroku add-ons catalog or command line tool:

$ heroku addons:add heroku-postgresql:dev

Check out the Heroku Postgres Blog to read more.

Heroku's new, free PostgreSQL 9.1 development database

Introducing the newest plan in the Herkou Postgres line-up: dev. It is an updated replacement for the PostgreSQL 8.3-based shared database add-on. This plan is available immediately in public beta:

$ heroku addons:add heroku-postgresql:dev

It can also be provisioned through the Heroku add-ons catalog.

What's New?

This new dev plan offers increased parity between our free database service and our paid, production plans. New features include:

How does it differ from production plans?

The dev plan is designed to offer the database features required for development and testing, without the production-grade operations, monitoring, and support found in our paid plans. Fork, follow, and automatic database backups are not available on the dev plan (manual backups are available on the dev plan).

In addition, the dev plan will have a limit on the number of rows that can be stored in the database. This represents a departure from the sized-based limit on our current shared plan, and is due to the fact that data storage layer mechanisms can cause confusing discrepancies relative to what a user would expect, particularly for small data sets. The limit will be set such that databases under the current size limit should be under the record limit as well.

Beta Period

The dev plan is available for testing in public beta. Although it is not designed for mission-critical data in any case (it is a development plan after all), the risk of data loss or unavailability is increased as a beta product. The dev plan will continue to be free once it has been released from beta.

What does it replace?

Once out of beta, the dev plan will replace the Postgres 8.3-based shared-database plans as the default & free relational database service on Heroku. The $15/month, Postgres 8.3-based 20gb plan continues to be available during this beta. It will also be replaced with a Postgres 9.1-based plan at a comparable price point.

It also replaces the private-beta Postgres 9.1-based heroku-shared-postgresql add-on, which is immediately deprecated.

Try it and send feedback

Try the development plan today:

$ heroku addons:add heroku-postgresql:dev

And send feedback to dod-feedback@heroku.com or @herokupostgres.

A Very Good Day For Postgres: Postgres.app, Postgres Guide, and Schemaless SQL

Today has been a very good day for Postgres.

We here at Heroku love Postgres, and we aren't afraid to show it. Here's how three different Herokai showed their PG love in three awesome ways in the last 24 hours:

Postgres.app is the easiest way to run PostgreSQL on the Mac. Just open the app, and you have a server up and running with Postgres 9.1 and PostGIS 2.0. PostgreSQL has not been the easiest things to install--especially for new developers--so we see Postgres.app as an important step in making the world's best database more accessible to everyone. Postgres.app was created by Mattt Thompson, and launched in beta today. It will soon be available as a free download in the Mac App Store.

From making Postgres easier to install to making it easier to understand, Craig Kerstien's Postgres Guide made its debut on the Hacker News front page to much acclaim. Craig's guide outlines the best features of Postgres in detailed, well-written prose that's easy to understand and a joy to read. It's still early in its development, but there are already some great gems in there, like the chapter on Views, and the articles about Indexes and Execution Plans.

Also spreading knowledge was Will Leinweber, who delivered his "Schemaless SQL" talk this afternoon at RailsConf in Austin. It was a veritable salvo of enthusiasm and insight; the audience hung on every word as Will demonstrated the power and flexibility of hstore. The often disparate worlds of RDBMS and NoSQL, united as one: it's a beautiful thing.

Today was a great day for Postgres, and Postgres can make your day great, too! Check out Postgres.app, Postgres Guide, and the slides about Schemaless SQL today, and prepare to fall in love.

The Heroku Changelog

The Heroku Changelog is a feed of all public-facing changes to the Heroku runtime platform. While we announce all major new features via the Heroku blog, we're making small improvements all the time. When any of those improvements have any user-visible impact, you'll find them in the changelog.

Some recent examples of posts to the changelog include new versions of the Heroku CLI, a new error code, and changes to logging.

To get the latest on changes like these, visit the Heroku Changelog, or subscribe via feed or Twitter.

Browse the blog archives or subscribe to the full-text feed.