I want to setup second level domain name e.g. load.staging.mydomain.com on Heroku & Cloudflare.

http://load.staging.mydomain.com (without TLS) works but https://load.staging.mydomain.com does not.

I already setup DNS entries, I created origin certificate on Cloudflare: *.mydomain.com, *.staging.mydomain.com, mydomain.com (3 hosts)

.. and I uploaded created certificate to Heroku ..

I am getting error when visiting TLS version of the URL:

Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite.

However: first level subdomains work. e.g. http://staging.mydomain.com

  • Suggest you edit your question to include the actual domain name. There's not much we can do to help with the information you provided.
    – Tim
    Aug 1 '18 at 8:58

I put your third level subdomain into the SSL Shopper SSL Checker. It says no SSL certificate is being presented at all for that domain. So the answer I have for you is your web server isn't sending the browser a certificate. See the image below.

I also note that the SSL Checker for the working domain includes an SSL certificate with a lot of alternate names, none of which are "load.staging.usefomo.com". That doesn't really mean anything though, as CloudFlare may have put that domain onto another cert.

Fomo SSL

  • This pointed me into the right direction - at least now I know where is the problem (cloudflare - not heroku) .. I added answer which details about what to do to set this up properly. Thanks!
    – knagode
    Aug 1 '18 at 9:41

The issue was that I was creating origin certificate (free feature) - not edge certificate.

To make second domain level work you need to turn on Dedicated SSL Certificate with Custom Hostnames (paid feature) on Cloudflare (Crypto section -> Edge Certificates -> Order SSL certificate).

Details on CloudFlare support forum

  • The obvious workaround then is not to use third level domains if you want to use the Cloudflare free plan. eg use load-staging.mydomain.com rather than load.staging.mydomain.com
    – Tim
    Aug 1 '18 at 17:40
  • I had the same problem as you. I needed to buy a certificate for the new subdomains. Feb 20 '20 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.