1316712 - Switch from the Heroku SSL endpoint addon to their new native SNI SSL support

Status: RESOLVED FIXED

(Tree Management :: Treeherder: Infrastructure, defect, P3)

Description

[Ed Morley [:emorley]]

Heroku's native SNI-based SSL has been out for a bit now:
https://blog.heroku.com/ssl-is-now-included-on-all-paid-dynos

We should consider switching to it from the SSL endpoint addon.

Pros:
* Doesn't require the $20/month addon
* Copes with spikes in load without needing to pre-warm
* Heroku have said it's recommended over the old SSL endpoint addon, and that new features will only be available on the SNI based solution
* the SNI based solution wasn't affected during the Dyn DDOS, unlike the SSL addon

Cons:
* Requires SNI, so can't be used by people on Windows XP who only have Internet Explorer installed (https://en.wikipedia.org/wiki/Server_Name_Indication#Support)

Switching process:
https://devcenter.heroku.com/articles/ssl#migrate-from-ssl-endpoint-to-heroku-ssl

Comment 1

[Ed Morley [:emorley]]

The only people who won't have SNI support are those on:
* Windows XP using Internet Explorer (whom are stuck on IE8 anyway, which we don't want to support regardless), though they can just use Firefox or Chrome instead
* Those on Android 2.3 using the stock browser (though they can use Firefox for Android/Chrome instead)

(from http://caniuse.com/#feat=sni)

So we don't need to worry about lack of support.

Comment 2

[Ed Morley [:emorley]]

Both apps switched over in the dep bugs, and I've removed the legacy SSL endpoint addon from both :-)