AppHarbor supports SSL in multiple ways, namely SNI SSL, piggyback and hostname/IP based SSL.

SNI SSL

SNI SSL is supported on AppHarbor for HTTPS traffic. Once the certificate is added you can access the application's url with https://example.com - no other changes are required to your application.

Please note that SNI SSL has limited browser support. Refer to http://en.wikipedia.org/wiki/Server_Name_Indication for more info (in particular, Chrome in Windows XP and all versions of IE running on Windows XP will display warnings).

Piggyback SSL

Applications on AppHarbor is enabled with piggyback SSL by default. You can access your site using HTTPS with your hostname like so: https://your-app-name.apphb.com address that is assigned to the application.

IP-based SSL

You can get IP-based SSL for your application for $100/month (AppHarbor has to run a custom load balancer for each IP-SSL enabled site). Just drop us a line on [email protected] and we'll set it up.

Getting a Certificate

SSL certificates can be purchased from a wide array of digital certificate providers or they can be self-signed. RapidSSL, GeoTrust and Comodo are a few popular choices.

You can usually find a walkthrough of how to create a certificate on the provider's website.

One of our users has written a good step-by-step blog post showing how the certificate creation process in IIS.

Uploading a Certificate

You can upload your own certificate in two ways: Either by using a public/private key pair or by uploading af *.pfx file. If your private key or pfx file needs a passphrase you can enter it when adding the certificate. A passphrase must always be supplied when uploading a pfx certificate. You can add a certificate to your application by clicking the "Certificates" link on your application's page.

Intermediate Certificates

When a certificate has been created for the application you can add intermediate certificates. Usually the certificate issuer includes any necessary intermediate certificates when you receive the certificate. If not you may have to contact the certificate issuer to get their intermediate certificate.

Troubleshooting

RequireHttpsAttribute: If you're using the built-in RequireHttpsAttribute to ensure that a controller action always uses HTTPS you will experience a redirect loop. The reason is that SSL is terminated at the load balancer level and RequireHttps doesn't recognize the X-Forwarded-Proto header it uses to indicate that the request was made using HTTPS. You should therefore use a custom RequireHttps attribute for this purpose. We've put up a sample RequireHttpsAttribute class which you can find here: https://gist.github.com/915869

Public/Private key header and footer: When uploading a certificate using public/private key pair make sure to include the header and footer (i.e. -----{BEGIN/END} CERTIFICATE----- and -----{BEGIN/END} RSA PRIVATE KEY-----

Pfx file fails when uploading: Some pfx files may fail when uploading. Try and import it in IIS and then export a new one to use on AppHarbor. Feel free to contact support if this doesn't solve the issue