title: HTTPS + SSL on Heroku - Node + Express
body: <p>I've created a <a href="https://devcenter.heroku.com/articles/ssl-certificate-self" rel="noreferrer">self-signed certificate</a>, <a href="https://devcenter.heroku.com/articles/ssl-endpoint" rel="noreferrer">added it to Heroku</a>, and provisioned an SSL endpoint on Heroku, and I log <code>heroku certs:info</code> it seems to be there.</p>
  
  <p>I'm creating my server on Express like so:</p>
  
  <pre><code>var server = require('http').createServer(app);
  </code></pre>
  
  <p>And then redirecting to <code>https</code> like so:</p>
  
  <pre><code>app.use(function(req, res, next) {
      var reqType = req.headers["x-forwarded-proto"];
      reqType == 'https' ? next() : res.redirect("https://" + req.headers.host + req.url);
  });
  </code></pre>
  
  <p>The server runs fine, however I came across this code snippet on S.O. to create an <code>https</code> server:</p>
  
  <pre><code>var keys_dir = './sslcert/';
  var server_options = { 
    key  : fs.readFileSync(keys_dir + 'server.key'),
    ca   : fs.readFileSync(keys_dir + 'server.csr'), 
    cert : fs.readFileSync(keys_dir + 'server.crt') 
  }
  
  var server = require('https').createServer(server_options,app);
  </code></pre>
  
  <p>I don't point to the certs/keys like this example, and my site is running on https (although the lock is red since it's self-signed).</p>
  
  <ul>
  <li><p>So my question is, how does my server know about my keys/certs without me explicitly pointing to them like the code snippet with <code>server_options</code>? Is this taken care of by Heroku behind the scenes? </p></li>
  <li><p>How does the SSL Endpoint I setup on Heroku interact with the <code>http</code> server I created with <code>var server = require('http').createServer(app);</code>? </p></li>
  </ul>
  
  <hr>
  
  <p>EDIT</p>
  
  <p>I just so this answer on <a href="https://stackoverflow.com/questions/11485880/heroku-error-h13-on-expressjs-node-https-server">another question</a>:</p>
  
  <p>"SSL termination occurs at Heroku's load balancers; they send your app plain (non-SSL) traffic, so your app should create a non-HTTPS server."</p>
  
  <ul>
  <li>What does <code>they send your app plain (non-SSL) traffic</code> mean exactly? Does this mean that I don't have to redirect to <code>https</code> in my app?</li>
  </ul>