Skip Navigation
Show nav
Dev Center
  • Get Started
  • Documentation
  • Changelog
  • Search
  • Get Started
    • Node.js
    • Ruby on Rails
    • Ruby
    • Python
    • Java
    • PHP
    • Go
    • Scala
    • Clojure
    • .NET
  • Documentation
  • Changelog
  • More
    Additional Resources
    • Home
    • Elements
    • Products
    • Pricing
    • Careers
    • Help
    • Status
    • Events
    • Podcasts
    • Compliance Center
    Heroku Blog

    Visit the Heroku Blog

    Find news and updates from Heroku in the blog.

    Visit Blog
  • Log inorSign up
Hide categories

Categories

  • Heroku Architecture
    • Compute (Dynos)
      • Dyno Management
      • Dyno Concepts
      • Dyno Behavior
      • Dyno Reference
      • Dyno Troubleshooting
    • Stacks (operating system images)
    • Networking & DNS
    • Platform Policies
    • Platform Principles
  • Developer Tools
    • Command Line
    • Heroku VS Code Extension
  • Deployment
    • Deploying with Git
    • Deploying with Docker
    • Deployment Integrations
  • Continuous Delivery & Integration (Heroku Flow)
    • Continuous Integration
  • Language Support
    • Node.js
      • Working with Node.js
      • Node.js Behavior in Heroku
      • Troubleshooting Node.js Apps
    • Ruby
      • Rails Support
      • Working with Bundler
      • Working with Ruby
      • Ruby Behavior in Heroku
      • Troubleshooting Ruby Apps
    • Python
      • Working with Python
      • Background Jobs in Python
      • Python Behavior in Heroku
      • Working with Django
    • Java
      • Java Behavior in Heroku
      • Working with Java
      • Working with Maven
      • Working with Spring Boot
      • Troubleshooting Java Apps
    • PHP
      • PHP Behavior in Heroku
      • Working with PHP
    • Go
      • Go Dependency Management
    • Scala
    • Clojure
    • .NET
      • Working with .NET
  • Databases & Data Management
    • Heroku Postgres
      • Postgres Basics
      • Postgres Getting Started
      • Postgres Performance
      • Postgres Data Transfer & Preservation
      • Postgres Availability
      • Postgres Special Topics
      • Migrating to Heroku Postgres
    • Heroku Key-Value Store
    • Apache Kafka on Heroku
    • Other Data Stores
  • AI
    • Working with AI
    • Heroku Inference
      • Inference API
      • Quick Start Guides
      • AI Models
      • Inference Essentials
    • Vector Database
    • Model Context Protocol
  • Monitoring & Metrics
    • Logging
  • App Performance
  • Add-ons
    • All Add-ons
  • Collaboration
  • Security
    • App Security
    • Identities & Authentication
      • Single Sign-on (SSO)
    • Private Spaces
      • Infrastructure Networking
    • Compliance
  • Heroku Enterprise
    • Enterprise Accounts
    • Enterprise Teams
    • Heroku Connect (Salesforce sync)
      • Heroku Connect Administration
      • Heroku Connect Reference
      • Heroku Connect Troubleshooting
  • Patterns & Best Practices
  • Extending Heroku
    • Platform API
    • App Webhooks
    • Heroku Labs
    • Building Add-ons
      • Add-on Development Tasks
      • Add-on APIs
      • Add-on Guidelines & Requirements
    • Building CLI Plugins
    • Developing Buildpacks
    • Dev Center
  • Accounts & Billing
  • Troubleshooting & Support
  • Integrating with Salesforce
  • Add-ons
  • All Add-ons
  • BrandSSL
BrandSSL

This add-on is operated by BrandSSL

On demand SSL Management solution for SaaS

BrandSSL

Last updated April 07, 2022

Table of Contents

  • Provisioning the Add-on
  • Connecting to the BrandSSL Dashboard
  • Configuring Application Endpoint and CNAME
  • Managing Domains
  • Migrating Between Plans
  • Removing the Add-on
  • Support

The BrandSSL add-on provides on-demand SSL management for SaaS applications. It manages the entire SSL lifecycle for a domain name, from private key creation and protection to domain validation, issuance, and reissue.

BrandSSL provides the following features:

  • An Anycast IP Address, that automatically route through the nearest region so that any domain can connect with reduced latency
  • Custom headers and metadata
  • URL Rewrites
  • API Access

Provisioning the Add-on

BrandSSL can be attached to a Heroku application via the CLI:

A list of all plans available can be found here

$ heroku addons:create brandssl
-----> Adding brandssl to sharp-mountain-4005... done, v18 (free)

Connecting to the BrandSSL Dashboard

Configure your application endpoint and CNAME from the BrandSSL dashboard. Access the dashboard via the CLI:

$ heroku addons:open brandssl
-----> Opening brandssl for sharp-mountain-4005

You can also visit the Heroku Dashboard, select your application, and then select BrandSSL from the addon list.

Configuring Application Endpoint and CNAME

From the BrandSSL dashboard, specify your application endpoint (the address of your web server) and a domain (CNAME) name.

Managing Domains

Manage domains from the BrandSSL dashboard. You can verify whether a domain is secured or unsecured. You can also disable custom domains you don’t want to secure.

On-Demand SSL

BrandSSL supports “on demand” and “API call” SSL certificate provisioning. With On demand provisioning, domain names pointed at your provided BrandSSL CNAME record is automatically secured. “API Call” provisioning requires you to send a post request with your API key to the BrandSSL server. On demand provisioning is the default.

Configuring URL Rewrite

Use the URL Rewrite feature to add a prefix or suffix to your application endpoint.

Examples:

  • Adding a prefix (“/static”) to the endpoint: /static{path} rewrites as /static/{user_path}
  • Adding a suffix (“/deploy”) to the endpoint: {path}/deploy rewrites as /{user_path}/deploy
  • Adding both a prefix (“/static”) and a suffix (“/deploy”) to the endpoint: /static{path}/deploy rewrites as /static/{user_path}/deploy.

Certificate Authority

Select a default issuer and manage your Certificate Authority account from the Settings page.

Configuring Cloudflare

BrandSSL works with Cloudflare in “Proxied” or “DNS only” modes.

You must provide a Cloudflare API token if you’re running BrandSSL behind the Cloudflare proxy.

Migrating Between Plans

Use the heroku add-ons:upgrade command to migrate to a new plan.

$ heroku add-ons:upgrade brandssl:newplan
-----> Upgrading brandssl:newplan to sharp-mountain-4005... done, v18 ($35/mo)
       Your plan has been updated to: brandssl:newplan

Removing the Add-on

You can remove Easy File Upload via the CLI:

This destroys all associated data and can’t be undone!

$ heroku add-ons:destroy brandssl
-----> Removing brandssl from sharp-mountain-4005... done, v18(free)

Support

All BrandSSL support and runtime issues should be submitted via one of the Heroku Support channels. Any non-support related issues or product feedback is welcome at sales@brandssl.io.

Keep reading

  • All Add-ons

Feedback

Log in to submit feedback.

Zara 4 BreezyPDF

Information & Support

  • Getting Started
  • Documentation
  • Changelog
  • Compliance Center
  • Training & Education
  • Blog
  • Support Channels
  • Status

Language Reference

  • Node.js
  • Ruby
  • Java
  • PHP
  • Python
  • Go
  • Scala
  • Clojure
  • .NET

Other Resources

  • Careers
  • Elements
  • Products
  • Pricing
  • RSS
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku Blog
    • Heroku News Blog
    • Heroku Engineering Blog
  • Twitter
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku
    • Heroku Status
  • Github
  • LinkedIn
  • © 2025 Salesforce, Inc. All rights reserved. Various trademarks held by their respective owners. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States
  • heroku.com
  • Legal
  • Terms of Service
  • Privacy Information
  • Responsible Disclosure
  • Trust
  • Contact
  • Cookie Preferences
  • Your Privacy Choices