HTTPS on Pantheon's Global CDN
Learn the specifics of Pantheon's Free and Automated HTTPS, powered by Let's Encrypt
Discuss in our Forum Discuss in SlackPantheon's new Global CDN provides free, automated HTTPS for every site launched on the platform.
Agency WebOps Training
Get the most out of Global CDN with help from the experts at Pantheon. We deliver on-demand training to help development teams master the platform and improve internal WebOps.
Configure DNS
The icon within the Domains / HTTPS page indicates that the domain has not been properly routed to Pantheon. The following actions are required:
- Access the Live environment in your Pantheon Site Dashboard.
- Navigate to the Domains / HTTPS page.
- Select Details next to the
www
domain. - In a separate window, log in to the DNS host for the domain.
- Copy the value provided in the Pantheon Site Dashboard for the required A record, then use it to create an A record wherever you manage DNS. Repeat this step for both of the AAAA records.
- Return to the Domains / HTTPS page in the Pantheon Site Dashboard.
- Click Details next to the bare domain.
- Copy the value provided in the Pantheon Site Dashboard for the required A record, then use it to create an A record wherever you manage DNS. Repeat this step for both of the AAAA records.
- Note that if the Platform detects a CNAME record, the Status will show
Remove this detected record
on the line with the CNAME. Remove the CNAME from the DNS management service to avoid potential issues or interruptions.
- Note that if the Platform detects a CNAME record, the Status will show
Note
When adding the domain to your environment, you may be presented with the option to Verify your domain to provision HTTPS. If you're using a manually managed custom certificate, skip this step by clicking Skip to updating DNS.
For more detailed instructions pertaining to your specific DNS host, click below:
DNS Host-Specific Instructions
- 1&1
- Amazon Route 53
- Cloudflare
- DNS Made Easy
- DreamHost
- Dyn
- Enom
- Gandi
- GoDaddy
- Namecheap
- Network Solutions
If you are having difficulties issuing a Let's Encrypt certificate you can run diagnostics at Let's Debug. This tool can identify an array of issues specifically for Let's Encrypt certificates including problems with DNS, nameservers, networking issues, common website misconfigurations, and CA policy issues.
Provision HTTPS
The process to provision certificates kicks off automatically after the domain has been successfully routed to Pantheon, indicated by the following notice:
HTTPS
Your DNS configuration is correct, and certificate provisioning is queued to start for this domain.
Both the bare domain and the www
domain will be accessible over HTTPS once the HTTPS status turns green (which may take up to an hour):
HTTPS
Let’s Encrypt certificate deployed to Pantheon’s Global CDN. Certificate renews automatically with no additional cost.
Let's Encrypt Certificates
Let's Encrypt is a free, automated, and open certificate authority that aims to make HTTPS the standard for all websites, a goal we share. Pantheon automatically provisions a Let's Encrypt certificate for your site, and always renews it automatically, for no additional cost. Let's Encrypt issued certs are valid for 90 days and we renew them 30 days before expiration.
Requirements for Automated Certificate Renewal
- All A/AAAA/CNAME/DNAME DNS records for any Pantheon-hosted domains (
example.com
) and/or subdomains (www.example.com
orblog.example.com
) must point to Pantheon's servers so Let's Encrypt can verify domain ownership. - AAAA records are not required, but if set must exclusively point to Pantheon.
- Authoritative Name Servers must serve mixed-case lookups, and must not fail CAA lookups.
- CAA records must either 1) not exist for the domain and its parent domains or 2) authorize Let's Encrypt. Note that CAA records are inherited by subdomains.
Technical Specifications
Global CDN with Let's Encrypt | Global CDN with a Custom Certificate | |
---|---|---|
Certificate Type | Issued by Let's Encrypt | Bring your own |
Renewal | Automatic | Self-managed (up to you) |
Inbound IP | Static (shared) | Static (shared) |
Client Support | 95.55% of Browsers Some very old browsers not supported 1 2 | 95.55% of Browsers Some very old browsers not supported 1 2 * |
SSL Labs Rating | A+ with HSTS | A+ with HSTS * |
Protocol | TLS 1.2 with SNI | TLS 1.2 with SNI |
Ciphers | No Weak 3DES cipher | No Weak 3DES cipher |
Delivery | Global CDN | Global CDN |
Encryption Endpoint | Application Container | Application Container |
* The browser compatibility and SSL Labs scores are guaranteed for Pantheon-provided Let’s Encrypt certificates. The same results are typical for a custom certificate from a mainstream CA with mainstream attributes, but not guaranteed. For custom certificates, compatibility and SSL Labs score depends on attributes of that certificate, such as number of SAN entries, CA and signing algorithm.
Frequently Asked Questions
How do I switch my site over to HTTPS from HTTP?
To avoid mixed-content browser warnings and excessive redirects, follow the process described in Switching Sites from HTTP to HTTPS.
How do I upgrade my existing Pantheon site?
Make the switch on an existing Pantheon site by updating DNS for your domains. If your site doesn't have the new combined "Domains/HTTPS" tab, open a support chat to get the upgrade enabled
What level of encryption is provided?
High grade TLS 1.2 encryption with up-to-date ciphers. For a deep analysis of the HTTPS configuration on upgraded sites see this A+ SSL Labs report for https://pantheon.io.
How can I obtain an A+ SSL Labs rating?
Upgrade your site to the Global CDN and then send the HSTS header.
Can I bring my own certificate?
Yes. See our page on custom certificates for more information.
But you shouldn't need to buy a custom certificate or worry about renewals in most cases. For example, wildcard certificates aren't necessary to secure communications for multiple domains, because we will automatically deploy certificates for all domains on your site. The certificates provided by Pantheon on the Global CDN provide end-to-end encryption.
Some customers have purchased expensive certificates, often through an upsell from the certificate authority. Unfortunately, an expensive certificate does not mean increased security. If in doubt, we encourage you to test your site with SSL Labs, compare it to this A+ report, and share it with your client.
If bringing your own certificate is a hard requirement, then we recommend terminating HTTPS through a 3rd-party CDN service provider like Cloudflare, CloudFront, StackPath, etc. Configuration differs depending on provider, so please contact support to discuss your case.
Is HTTPS encryption end-to-end?
Yes! HTTPS is terminated at the CDN edge and traffic is encrypted all the way to the individual application container. This is an improvement over our legacy system that terminated all encryption at the load balancer, and a huge upgrade over setups which use a "mixed mode" strategy of terminating HTTPS at the CDN and then back-ending to the origin over unencrypted clear text communication.
Will HTTPS be available for my site throughout the upgrade process?
Yes! As long as you are following the Dashboard DNS recommendations before starting the upgrade, you will see no interruption in HTTPS service. The process to provision certificates can take up to an hour, after which you can update DNS records without HTTPS interruption.
Existing sites that are not already hosted on Pantheon can pre-provision HTTPS to avoid interruption. If you are unable to prove ownership as described, we recommend a maintenance window.
Note
You can pre-provision HTTPS via DNS records, or the Let's Encrypt ACME challenge file. You cannot use the challenge file if:
- You cannot host the provided verification file on the current site.
- Your current server doesn't support files without extension names (like IIS with .NET)
Verifying with the provided DNS record is the preferred method for customers who can make new DNS records for their domain(s).
In some cases, such as when the custom domain has an existing third-party CAA, you must manually add the Let's Encrypt CAA.
Let’s Encrypt’s identifying domain name for CAA is letsencrypt.org. For more official information, read Let's Encrypt's Certification Practice Statement CPS, section 4.2.1..
This tool can be used to gather more info on how pass the custom domain verification https://letsdebug.net/
If you do not already have HTTPS, you don't need to pre-provision, but doing so will allow you to launch your Pantheon site with HTTPS already enabled, and is recommended.
How many custom domains are supported?
A paid plan is required to connect custom domains to your site, up to the following limits:
Basic | Performance S | Performance M | Performance L | Performance XL | Elite | |
---|---|---|---|---|---|---|
Custom Domain Limit (per site) | 5 | 10 | 15 | 35 | 70 | 270 |
Free and Managed HTTPS | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Which browsers and operating systems are supported?
All modern browsers and operating systems are supported. For details, see the Handshake Simulation portion of this report.
What about Cloudflare?
Refer to Cloudflare Domain Configuration.
For how long are Let's Encrypt certificates valid and what happens when they expire?
Let's Encrypt certificates are valid for 90 days and are automatically updated on the platform before they expire.
Known Issues
HTTPS doesn't provision with incorrect AAAA configurations
Pantheon cannot not begin provisioning HTTPS if the Site Dashboard detects incorrect values set on AAAA records. Once you update the records using the recommended values, HTTPS will start to provision automatically. The values for AAAA records look similar, but they are distinct.
Certificate Mismatch Browser Warning
If your DNS changes propagate before certificates are fully deployed across the CDN, it's possible to see a certificate mismatch. To avoid this situation, wait a full 60 minutes from starting the upgrade to updating DNS. If you see a certificate mismatch, you can simply wait it out (up to 60 minutes), though you may also be able to see the new service in action more quickly using a different browser or incognito window.
HTTPS doesn't provision with Sucuri's default settings
By default Sucuri blocks serving the challenges needed to verify domain ownership and issue Let's Encrypt certificates. Contact Sucuri support and request they enable the "Forward Certificate Validation" setting, which allows HTTPS provisioning to complete successfully. Note you'll want to keep this setting enabled, so the certificate will always renew automatically.
Moz Pro 804 HTTPS SSL error
Moz Pro is unable to crawl sites using Server Name Indication (SNI). For information on beta access to SNI support, see Moz Pro, our web crawler, and sites that use SNI (804 HTTPS SSL) error.
403 Permission Denied (Drupal)
The text challenge to pre-provision HTTPS on Pantheon requires adding a .well-known
directory to the root of your site. However, Drupal core has a line in the .htaccess
file that disallows Apache from serving dot files and folders, which returns a 403 permission denied response. If you see this error while trying to pre-provision HTTPS on Drupal sites, use the Let's Encrypt Challenge contrib module as a workaround.
Addressing Let's Encrypt Rate Limits
Pantheon requests new certificates frequently in order to add domains to existing certificates. This can potentially expose organizations managing many domains to Let's Encrypt rate limits. While sites hosted on Pantheon are not subject to these lower limits, sites hosted off the platform may experience request failures.
If you encounter rate limits, we recommend the following approaches:
- Ask Let's Encrypt to increase your rate limit.
- Consider using another certificate service for sites that are not on Pantheon. For example, educational institutions may want to consider using the Incommon Certificate Service as a workaround.
Glossary
HTTPS
HTTPS encrypts and decrypts requests. For more information, see this Google resource.
TLS (Transport Layer Security)
TLS (Transport Layer Security) is a protocol for secure HTTP connections. It replaces its less secure predecessor, the SSL (Secure Socket Layer) protocol, which we no longer support. Pantheon uses the term HTTPS to refer to secure HTTP connections.
Server Name Indication (SNI)
Server name indication (SNI) is the technology replacing the expensive, legacy load balancers and allows multiple secure (HTTPS) websites to be served off the same IP address, without requiring all those sites to use the same certificate.