title: Heroku: Spring Boot Gradle app with https tomcat server and certificate pinning
body: <p>I have a Spring Boot java app that uses a self-signed certificate to communicate with the android front-end.</p>
  
  <p>I use a tomcat server as my container for the app:</p>
  
  <pre><code>compile 'org.springframework.boot:spring-boot-starter-tomcat'
  </code></pre>
  
  <p>Now, I have enabled https / ssl:</p>
  
  <pre><code>            TomcatEmbeddedServletContainerFactory tomcat = (TomcatEmbeddedServletContainerFactory) container;
              tomcat.addConnectorCustomizers(connector -&gt; {
                  connector.setPort(Integer.parseInt(serverPort));
                  connector.setSecure(true);
                  connector.setScheme("https");
  </code></pre>
  
  <p>I have to enable SSL as I want my android frontend to communicate to my server securely. I use the technique called certificate pinning which means I add the same self-signed certificate to both my server and my android app. For any http communications between the two, the communication will be encrypted with the keys of the <strong>same</strong> certificate and hence the server and android app will be able to understand one another.</p>
  
  <p>When I load it into Heroku, I get errors each time I try to call the server:</p>
  
  <pre><code>2015-12-11T20:04:32.424629+00:00 heroku[router]: at=error code=H13 desc="Connection closed without response" method=GET path="/getfood?postid=566348364a918a12046ce96f" host=app.herokuapp.com request_id=bf975c13-69f3-45f5-9e04-ca6817b6c410 fwd="197.89.172.181" dyno=web.1 connect=0ms service=4ms status=503 bytes=0
  </code></pre>
  
  <p>According to this blog by Julie: <a href="http://juliekrueger.com/blog/" rel="noreferrer">http://juliekrueger.com/blog/</a></p>
  
  <blockquote>
    <p>As a side note, Heroku apps are https enabled by default. The server I
    was installing had Tomcat configured to use https, and trying to
    access an endpoint was returning a code=H13 desc="Connection closed
    without response" error. After I removed that configuration the error
    went away.</p>
  </blockquote>
  
  <p>I can fix the error by just removing the ssl / https from my tomcat server, but as I mentioned, I want to use the certificate pinning technique for secure communications.</p>
  
  <p>I was thinking whether it was possible to disable the SSL on heroku side but keep my tomcat server SSL active but I already contacted Heroku and they told me that disabling the piggyback SSL that comes standard with their service is not possible.</p>
  
  <p>I also looked at the paid alternative here called SSL Endpoint but it seems only userful for custom domains. Since all endpoints are coded within my android app and is not visible to the user, it makes no sense for me to use a custom domain. Furthermore, I don't think it will solve my problem as its sole objective seems to be to create the custom domain: </p>
  
  <blockquote>
    <p>SSL Endpoint is only useful for custom domains. All default
    appname.herokuapp.com domains are already SSL-enabled and can be
    accessed by using https, for example, <a href="https://appname.herokuapp.com" rel="noreferrer">https://appname.herokuapp.com</a>.</p>
  </blockquote>
  
  <p>I googled for a few days now and cannot seem to come up with a solution. Disabling ssl on my tomcat side would not be acceptable in my mind as it poses too much risks. I would even consider other services (Azure etc) if this would solve my problem.</p>
  
  <p>Any ideas on how I can solve this?</p>