Heroku丢失了GeoTrust Global CA根证书

Question

Heroku以某种方式丢失了其GeoTrust Global CA根证书，这是在Apple服务器上使用推送通知所必需的。我在这里找到了证书，但我不确定如何在我的Heroku应用程序中安装它。我尝试通过应用程序的设置将其添加为SSL证书，但它说我需要一个私钥 - 我在哪里可以获得根证书？还是我应该在其他地方添加这个？

我应该指定我的应用程序是一个golang应用程序。

Answer 1

我重新定义了sideshow/apns2客户端工厂功能，将GeoTrust CA包含在rootCA中，并且Apple的apns服务器可以访问Heroku上的应用程序。const (&nbsp; &nbsp; GeoTrustCACert = "<path to GeoTrust_Global_CA.pem>")func newCertPool(certPath string) (*x509.CertPool, error) {&nbsp; &nbsp; rootCAs, _ := x509.SystemCertPool()&nbsp; &nbsp; if rootCAs == nil {&nbsp; &nbsp; &nbsp; &nbsp; rootCAs = x509.NewCertPool()&nbsp; &nbsp; }&nbsp; &nbsp; certs, err := ioutil.ReadFile(certPath)&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; return nil, errors.New("no certs appended, using system certs only")&nbsp; &nbsp; }&nbsp; &nbsp; if ok := rootCAs.AppendCertsFromPEM(certs); !ok {&nbsp; &nbsp; &nbsp; &nbsp; log.Println("no certs appended, using systems only certs")&nbsp; &nbsp; }&nbsp; &nbsp; return rootCAs, nil}func NewApns2ClientWithGeoTrustCA(certificate tls.Certificate) *apns2.Client {&nbsp; &nbsp; rootCas, err := newCertPool(GeoTrustCACert)&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; return nil&nbsp; &nbsp; }&nbsp; &nbsp; tlsConfig := &tls.Config{&nbsp; &nbsp; &nbsp; &nbsp; RootCAs:&nbsp; &nbsp; &nbsp; rootCas,&nbsp; &nbsp; &nbsp; &nbsp; Certificates: []tls.Certificate{certificate},&nbsp; &nbsp; }&nbsp; &nbsp; if len(certificate.Certificate) > 0 {&nbsp; &nbsp; &nbsp; &nbsp; tlsConfig.BuildNameToCertificate()&nbsp; &nbsp; }&nbsp; &nbsp; transport := &http2.Transport{&nbsp; &nbsp; &nbsp; &nbsp; TLSClientConfig: tlsConfig,&nbsp; &nbsp; &nbsp; &nbsp; DialTLS:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;apns2.DialTLS,&nbsp; &nbsp; }&nbsp; &nbsp; return &apns2.Client{&nbsp; &nbsp; &nbsp; &nbsp; HTTPClient: &http.Client{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Transport: transport,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Timeout:&nbsp; &nbsp;apns2.HTTPClientTimeout,&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; Certificate: certificate,&nbsp; &nbsp; &nbsp; &nbsp; Host:&nbsp; &nbsp; &nbsp; &nbsp; apns2.DefaultHost,&nbsp; &nbsp; }}

Answer 2

本周我们遇到了类似的问题，并通过直接在 Heroku 仪表板中将证书添加到 App 变量来解决。根据文档，您也可以再次手动添加 CA。https://devcenter.heroku.com/articles/ssl

Answer 3

我们在春季启动应用程序中也遇到了类似的问题，该应用程序使用工件“pushy”，groupId“com.eatthepath”和“0.14.2”版本的依赖性来表示APN推送通知并部署在heroku中。为了解决这个问题，我们按照这个链接中的步骤操作：https://help.heroku.com/447CZS8V/why-is-my-java-app-unable-to-find-a-valid-certification-path&nbsp;和&nbsp;https://devcenter.heroku.com/articles/customizing-the-jdk，然后在构建ApnsClientBuilder时还使用了“CaCertUtil”类和“GeoTrust_Global_CA.pem”文件，并添加了“.setTrustedServerCertificateChain（CaCertUtil.allCerts（））;”行。“CaCertUtil”和“GeoTrust_Global_CA.pem”取自此链接&nbsp;https://github.com/wultra/powerauth-push-server/commit/71abeb5663201fedf64830fa0ebdf4db6c537e4b。