I've created a self-signed certificate, added it to Heroku, and provisioned an SSL endpoint on Heroku, and I log heroku certs:info it seems to be there.
I'm creating my server on Express like so:
var server = require('http').createServer(app);And then redirecting to https like so:
app.use(function(req, res, next) { var reqType = req.headers["x-forwarded-proto"]; reqType == 'https' ? next() : res.redirect("https://" + req.headers.host + req.url);});The server runs fine, however I came across this code snippet on Stack Overflow to create an https server:
var keys_dir = './sslcert/';var server_options = { key : fs.readFileSync(keys_dir +'server.key'), ca : fs.readFileSync(keys_dir +'server.csr'), cert : fs.readFileSync(keys_dir +'server.crt') }var server = require('https').createServer(server_options,app);I don't point to the certs/keys like this example, and my site is running on https (although the lock is red since it's self-signed).
So my question is, how does my server know about my keys/certs without me explicitly pointing to them like the code snippet with
server_options? Is this taken care of by Heroku behind the scenes?How does the SSL Endpoint I setup on Heroku interact with the
httpserver I created withvar server = require('http').createServer(app);?
I saw this answer on another question:
"SSL termination occurs at Heroku's load balancers; they send your app plain (non-SSL) traffic, so your app should create a non-HTTPS server."
- What does
they send your app plain (non-SSL) trafficmean exactly? Does this mean that I don't have to redirect tohttpsin my app?