GoDaddy SSL证书在Heroku上无法正常工作的问题求助

Let’s troubleshoot your SSL issue step by step—this is a common gotcha when working with GoDaddy certificates and Heroku’s SSL Endpoint. Here’s what to do:

1. Create the Correct Certificate Bundle #

GoDaddy provides two critical files: your domain-specific certificate (the single-file one, e.g., server.crt) and a chain of intermediate certificates (the file with 3 certs). Heroku requires these combined into a single bundle file in the exact right order:

• Open your server.crt in a text editor and copy all its content.
• Open the 3-certificate file, copy all its content, and paste it after the content of server.crt.
• Save this combined file as bundle.crt.

Important: Don’t reorder the certificates—your domain cert must come first, followed by the intermediate certs in the order GoDaddy provided. Skipping this step causes incomplete chain errors (like the Firefox issue you encountered earlier).

2. Verify Certificate and Private Key Match #

A mismatch between your certificate and private key will throw cryptic errors. Use these OpenSSL commands to confirm they’re paired correctly:

# Check certificate modulus
openssl x509 -noout -modulus -in server.crt | openssl md5

# Check private key modulus
openssl rsa -noout -modulus -in server.key | openssl md5

The output of both commands must be identical. If not, you’re using the wrong key—go back to GoDaddy to reissue the certificate with the CSR you generated initially.

3. Clean Up Old Heroku SSL Configurations #

Remove any existing invalid certificates from Heroku to avoid conflicts:

heroku certs:remove

Confirm the removal when prompted.

4. Install the Proper Bundle on Heroku #

Now install your correctly assembled certificate bundle and private key:

heroku certs:add bundle.crt server.key --type endpoint

If this succeeds, you’ll see details for your SSL Endpoint (including the target domain you need for DNS setup).

5. Fix Your DNS Setup #

Your current bare-domain forwarding can break SSL handshakes. Instead:

• For www.mywebsite.com: Set a CNAME record pointing to the Heroku SSL Endpoint domain (from the heroku certs output).
• For your bare domain (e.g., mywebsite.com): Use an ALIAS/ANAME record (if your DNS provider supports it) pointing to the same SSL Endpoint domain. Avoid domain forwarding entirely—it often proxies traffic in a way that breaks SSL validation.

6. Test the SSL Setup #

Wait 5-10 minutes for DNS to propagate, then test with curl:

curl -v https://www.mywebsite.com

You should see a successful handshake without the tlsv1 alert internal error message. You can also use SSL validation tools to confirm the certificate chain is complete.

内容的提问来源于stack exchange，提问作者Nick Res