我可以忽略/拒绝对我的 heroku 应用程序的某些位置的 https 访问吗？
我正在 Heroku 上开发一个带有几个子域的网站。其中之一是注册（如在signup.myapp.com 中），它需要SSL 访问——当然！但其余的子域名，例如www，则不需要https来访问。
问题是客户只为signup.myapp.com购买了SSL认证。这意味着，当用户尝试使用 https 访问我网站的其他位置时（例如 https://www.myapp.com ），SSL 认证不会生效，浏览器会告诉用户该网站可能是恶意的......不利于品牌推广。
我尝试将站点从 https 重定向到 http，但这当然失败了，因为在发送重定向之前检查了 SSL。
有没有办法可以拒绝从 https 访问我网站的这些位置，以便用户遇到 404 页面等问题？或者，您知道还有其他方法可以处理这种情况吗？ （客户端不愿获取新的 SSL 证书，特别是通配符证书）。
I'm developing on Heroku a site with a couple of subdomains. One of them is signup (as in signup.myapp.com) which requires SSL access -- of course! But the rest of the subdomains, such as www, do not require https to access.
The problem is that the client only purchased an SSL certification for signup.myapp.com. This means that, when a user tries to access other places of my site with https (such as https://www.myapp.com), SSL certification does not validate and browsers tell the user that the site could be malicious... not good for branding.
I tried to make the site redirect from https to http, but of course this failed, because SSL was checked before the redirect could be sent.
Is there a way that I can deny access to these places of my site from https, so that users encounter, for instance, a 404 page instead? Or, do you know of any other ways to handle this situation? (the client is reticent to acquire a new SSL certificate, specially a wildcard certificate).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不幸的是，您需要每个域的证书（或您提到的通配符），请参阅例如：
问题是证书是首先检查的事情，远远早于其他任何事情发生。如果失败，浏览器通常会显示“让我离开这里！”之类的通知。没有对 SSL 到非 SSL 转换的内置支持。
您可以关闭 https://www.example.com （即让您的 Web 服务器不侦听端口 443 ），但这当然不会产生 404，这也不利于品牌推广。
如果只有一个非通配符证书，您唯一能做的就是将所有页面放在该域下。即而不是 https://signup.example.com/a/b/c ，您需要执行 https://www.example.com/signup/a/b /c 或类似的内容。
另一方面，您可以在 GoDaddy 以每年 100 美元以下的价格（或 2 年总计 150 美元）购买证书：
因此，根据您的情况，它可能会得到回报这而不是进行任何额外的开发。
Unfortunately, you need a certificate for each of the domains (or a wildcard one as you mention), see e.g.:
The problem is that certificate is the first thing checked, way before anything else happens. If that fails, browser will typically display "get me out of here!"-kind of notification. There's no built in support for SSL-to-non-SSL transition.
You can shut down https://www.example.com (i.e. make your Web server not listen on port 443), but that of course won't yield a 404, also bad for branding.
With just one non-wildcard certificate, the only thing you can do is put all the pages under that domain. I.e. instead of https://signup.example.com/a/b/c, you need to do https://www.example.com/signup/a/b/c or something along those lines.
On the other hand, you can buy the certificate for under $100/year (or $150 total for 2 years) at GoDaddy:
so, depending on your context, it might just pay off to pay this instead of doing any additional development.