How to disable SSL for custom subdomain

Question

I've got a non wildcard SSL certificate for my root domain (example.com), and I'm using the heroku ssl endpoint add on. I'm using routing constraints so subdomain.example.com matches various controller actions, and I reroute the subdomain with CNAME records to the root domain. This all works fine in development, and it works fine in Tor browser if I disable https, but I can't get it to work in any ordinary browser.

I've tried using gem SSL-enforcer to enforce SSL except on host with subdomain as such:

config.middleware.use Rack::SslEnforcer, :except_hosts => 'subdomain.mydomain.com', :strict => true

Can I disable the https protocol for subdomain of my rails app? I feel like this might be impossible as I've read that SSL negotiations are made before the server knows the URL.

Answer 1

I would have recommended SSL-enforcer.....

Are you using config.force_ssl and generating a strict transport security header? I would suspect that might be the issue if it works with Tor but not a normal browser. Check the headers; if the HSTS exists, then that's probably the reason. Should be straight forward to change that (changing the max-age attribute to 0)

If not, check the Heroku docs again and make sure your settings and DNS/CNAME are correct.... https://devcenter.heroku.com/articles/ssl-endpoint#subdomain

Hope this helps.