Docs

Troubleshooting Apex Domain SSL Errors

Overview

The symptom: https://www.example.com works normally, but https://example.com (the bare or “apex” domain) shows a certificate warning, often an expired certificate for a domain you do not recognize.

For a standard www setup, the WAF-managed certificate covers both your apex and www hostnames, so when only the apex fails, the cause is almost always DNS: the apex is not pointing at the WAF.

The Usual Cause: an Old Redirect Service

Many sites were originally set up with a third-party redirect service on the apex (NakedSSL, wwwizer, or a registrar’s forwarding feature) to bounce example.com to www.example.com. If that service is later shut down or its certificate expires, visitors to the bare domain get its broken certificate instead of yours.

Diagnose

Compare the A records for the apex and www using DNS is Beautiful: enter your bare domain (example.com), note the A record IP, then run a second lookup for www.example.com.

If www returns your WAF IP (shown on your WAF setup page) but the apex returns a different IP, the apex is pointing at something else. You can look up the unknown IP to confirm it belongs to a redirect service.

Because DNS is Beautiful queries resolvers around the world, it also shows whether a recent DNS change has finished propagating everywhere.

Fix

  1. At your DNS provider, update the A record for the apex domain to the same WAF IP your www record uses.
  2. Add the apex domain to your Heroku app’s custom domains (Settings, then Domains) so Heroku routes requests for it. The www entry alone does not cover the apex.
  3. Remove the old forwarding/redirect service. Once the apex points at the WAF, it is no longer doing anything.

DNS changes can take up to 24 hours to propagate, though most complete within an hour. After the change, both hostnames serve the same WAF-managed certificate.

If You Want Apex-to-www Redirection

Pointing both hostnames at the WAF serves your site at both. The WAF does not redirect one to the other; if you want visitors on the apex to land on www (or vice versa), handle that redirect in your application. See URL Redirects and Rewrites.

Need Help?

If the certificate warning persists after updating your DNS: