title: SSL on wildcard subdomains with CloudFlare and Heroku
body: <p>I'm working on a Ruby on Rails SaaS app with a custom subdomain for each company. When a company signs up, the user is redirected to her <em>subdomain.myapp.io</em>.</p>
  
  <p>The app is hosted on Heroku and DNS are managed at CloudFlare. I use the free SSL feature provided by CloudFlare, which works as expected for <a href="https://myapp.io" rel="noreferrer">https://myapp.io</a>.</p>
  
  <p>My issue is about having SSL active for the subdomains. I wonder if this is possible without buying a wildcard SSL certificate.</p>
  
  <p>CloudFlare DNS setup:</p>
  
  <pre><code>myapp.io.   300 IN  CNAME   myapp.herokuapp.com.
  *.myapp.io. 300 IN  CNAME   myapp.herokuapp.com.
  </code></pre>
  
  <p>Heroku domains setup:</p>
  
  <pre><code>myapp.io
  *.myapp.io
  </code></pre>
  
  <p>This works, but without SSL on subdomains. It is not possible to use CloudFlare features (such as SSL Full) for wildcard subdomains (except for Entreprise plan users).</p>
  
  <p>I think I need to buy a wildcard SSL certificate for my domain ($115/year) and add the <em>SSL Endpoint</em> Heroku add-on ($7/month). Am I wrong?</p>