Docs

Troubleshooting Apex Domain SSL Errors

Overview

The symptom: https://www.example.com works normally, but https://example.com (the bare or “apex” domain) shows a certificate warning, often an expired certificate for a domain you do not recognize.

For a standard www setup, the WAF-managed certificate covers both your apex and www hostnames, so when only the apex fails, the cause is almost always DNS: the apex is not pointing at the WAF.

The Usual Cause: an Old Redirect Service

Many sites were originally set up with a third-party redirect service on the apex (NakedSSL, wwwizer, or a registrar’s forwarding feature) to bounce example.com to www.example.com. If that service is later shut down or its certificate expires, visitors to the bare domain get its broken certificate instead of yours.

Diagnose

Compare the A records for the apex and www using DNS is Beautiful: enter your bare domain (example.com), note the A record IP, then run a second lookup for www.example.com.

If www returns your WAF IP (shown on your WAF setup page) but the apex returns a different IP, the apex is pointing at something else. You can look up the unknown IP to confirm it belongs to a redirect service.

Because DNS is Beautiful queries resolvers around the world, it also shows whether a recent DNS change has finished propagating everywhere.

If the apex already returns your WAF IP but shows a Heroku “No such app” page, the apex is missing from your Heroku app’s custom domains. Step 2 below fixes that.

Fix

  1. At your DNS provider, set the A record for the apex domain to the same WAF IP your www record uses, and remove any other A, AAAA, or ALIAS records on the apex.
  2. Add the apex domain to your Heroku app’s custom domains (Settings, then Domains, or heroku domains:add example.com -a your-app) so Heroku routes requests for it. The www entry alone does not cover the apex. Heroku shows a DNS target afterward; leave your DNS pointed at the WAF and ignore it.
  3. Remove the old forwarding/redirect service. Once the apex points at the WAF, it is no longer doing anything.

DNS changes can take up to 24 hours to propagate, though most complete within an hour. After the change, both hostnames serve the same WAF-managed certificate.

Do I Still Need a Redirect Service?

No. Point the apex at the WAF and remove the service.

Redirect services are popular on Heroku because a custom domain there is reached through a DNS target hostname, and a CNAME record can’t be used on an apex domain. Many DNS providers have no other way to point an apex at a hostname. With the WAF in front, the apex uses a plain A record, so that limit doesn’t apply.

Keeping the apex on the WAF is also what allows your certificate to renew. For a www site, automatic renewal requires the bare domain to resolve only to the WAF IP address, so an apex left on a redirect service will make renewal fail even when www is on the WAF. See SSL Certificate Renewal Process.

If You Want Apex-to-www Redirection

Pointing both hostnames at the WAF serves your site at both. The WAF does not redirect one to the other; if you want visitors on the apex to land on www (or vice versa), handle that redirect in your application. See URL Redirects and Rewrites.

Need Help?

If the certificate warning persists after updating your DNS: