Automate Lets Encrypt certificate generation for Heroku via Server

automate-letsencrypt-heroku

apt update

# install acme.sh
curl https://get.acme.sh | sh

# install heroku-cli
apt install snapd
sudo snap install --classic heroku
heroku login --interactive

# for cloudflare dns (will be stored in .acme.sh/account.conf)
export CF_Email=$CLOUDFLARE_EMAIL
export CF_Key=$CLOUDFLARE_API_KEY

# you own $DOMAIN and issue a certificate and update it upon renewal to your heroku app
acme.sh --issue -d $DOMAIN --dns dns_cf --renew-hook "~/heroku-script.sh $DOMAIN $HEROKU_APP"

# you own $MY_ALIAS_DOMAIN but offer your user a $CUSTOM_DOMAIN 
acme.sh --issue -d $CUSTOM_DOMAIN --domain-alias $MY_ALIAS_DOMAIN --dns dns_cf --renew-hook "~/heroku-script.sh $CUSTOM_DOMAIN $HEROKU_APP"


# a cronjob will be created and renew each domain you will subsequently create.
# however, we still need to push the certificates to heroku once
heroku certs:add /root/.acme.sh/$DOMAIN/fullchain.cer /root/.acme.sh/$DOMAIN/$DOMAIN.key --app $HEROKU_APP

heroku_script.sh

#!/bin/bash

DOMAIN="$1"
HEROKU_APP="$2"

heroku certs:update "/root/.acme.sh/$DOMAIN/fullchain.cer" "/root/.acme.sh/$DOMAIN/$DOMAIN.key" --confirm $HEROKU_APP --app $HEROKU_APP