1305199 - Change DNS for (www.)standu.ps

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Description

[Paul [:pmac] McLanahan]

I've added a cert for (www.)standu.ps to the Heroku app in bug 1300770. As part of that I need to alter the DNS entries. The output from the command to add the cert included the following:

=== Your certificate has been added successfully.  Update your application's DNS settings as follows
Domain         Record Type  DNS Target
─────────────  ───────────  ───────────────────────────
standu.ps      ALIAS/ANAME  standu.ps.herokudns.com
www.standu.ps  CNAME        www.standu.ps.herokudns.com


I know we don't support ALIAS records in our infra. All we need is for "https?://standu.ps" to redirect to "https://www.standu.ps". The CNAME for the www.standu.ps domain is the important bit.

We should wait to do this until at least Monday, Sept 26. No point making these changes over a weekend, but I did want to get the request in so I don't forget anything.

Thanks!

Comment 1

[Paul [:pmac] McLanahan]

I've tested this via setting my local /etc/hosts for www.standu.ps to point to an IP from www.standu.ps.herokudns.com and going to https://www.standu.ps. Everything works fine and I see the correct cert. I have to change settings in the app to prevent the mixed-content warnings, but I'll do that after this is done. So I'm ready when you are.

Comment 2

[Joey Krejci [:joeyk]]

Added this change and confirmed it works. Also imported cert onto ZLB. Closing out bug now. 

www.standu.ps  CNAME        www.standu.ps.herokudns.com

Comment 3

[:Atoll]

We have a couple things left to fix on the top-level domain that we have as part of this request:

$ curl -v https://standu.ps/
< HTTP/1.1 302 Found
< X-Backend-Server: pp-web02
< Location: https://www.standu.ps/

This should be a redirect to https://standu.ps/

$ curl -v https://standu.ps/
< HTTP/1.1 302 Found
< X-Backend-Server: pp-web04
< Location: https://www.standu.ps/

This is missing the Strict-Transport-Security header.

Comment 4

[:Atoll]

(In reply to Richard Soderberg [:atoll] from comment #3)
> We have a couple things left to fix on the top-level domain that we have as
> part of this request:
> 
> $ curl -v https://standu.ps/

Oops, first output is from http://, second is from https://

Comment 5

[Paul [:pmac] McLanahan]

This seems to be working well. Some tweaks suggested by :atoll then we'll be done. Thanks again!

Comment 6

[Joey Krejci [:joeyk]]

:pmac :atoll Added HSTS header line, confirmed with :ericz it's working. Closing bug now.