Setting Up HTTPS Link Tracking
  • 5 Minutes To Read

Setting Up HTTPS Link Tracking


By default, tracked links that use your custom subdomain as specified with the CNAME record will be generated as non-secure HTTP links. To have us generate secure HTTPS links instead, you will need to configure your link tracking subdomain to point to a server that will proxy our link tracking domain (track.customer.io) using a valid SSL certificate. It is not currently possible to have us generate secure HTTPS links without using your own custom subdomain.

For iOS or Android app links, please read the important information about setting up secure link tracking on those links in our Universal Links documentation. If you just want to enable HTTPS on regular links, we show two simpler configurations below:

WARNING!!!

If you have already configured a link tracking domain in your Customer.io workspace(s), we recommend that you continue using that domain (e.g., link.example.com) as you enable HTTPS link tracking. Changing your link tracking domain will cause your existing tracked links to break.

Setting up HTTPS Link Tracking with Amazon CloudFront

  1. Log into Amazon CloudFront and navigate to the AWS Certificate Manager.

  2. Request a new SSL certificate for the domain you want us to use for your tracked links (e.g. link.example.com).

  3. AWS will send an email to the appropriate domain owners, requesting them to approve the certificate or you can verify ownership by adding a DNS record.

HTTPS Links - AWS Certificate Manager

  1. Ensure that the certificate is approved and issued.

  2. Navigate to AWS CloudFront.

  3. Create a new distribution with Web as the delivery method.

  4. Under the Origin Settings section, set the fields as follows:

HTTPS Links - CloudFront Origin Settings

  • Origin Domain Name: track.customer.io
  • Origin ID: track.customer.io
  • Minimum Origin SSL Protocol: only TLSv1.2
  • Origin Protocol Policy: HTTPS Only
  1. Under the Default Cache Behavior Settings section, set the fields as follows:

HTTPS Links - CloudFront Cache Behavior Settings

  • Allowed HTTP Methods: GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE
  • Cache and origin request settings: Use legacy cache settings
  • Cache Based on Selected Request Headers: All
  • Forward Query Strings: Forward all, cache based on all
  1. Under the Distribution Settings section, set the fields as follows:

HTTPS Links - CloudFront Distribution Settings

  • Alternate Domain Names (CNAMES): link.example.com (replace with your preferred link tracking domain)
  • SSL Certificate: Select the Custom SSL Certificate option and choose the appropriate ACM certificate
  1. Click the Create Distribution button.

  2. Wait for the distribution status to be "Deployed".

  3. Add (or update) a CNAME record in your link tracking domain's DNS for the domain you are configuring (e.g., link.example.com) and point it to the CloudFront Domain Name (e.g., CHANGEME.cloudfront.net).

HTTPS Links - CloudFront Distribution Overview

The host name and value for your CNAME record will be something like:

  • CNAME record host name: link.example.com
  • CNAME record value: CHANGEME.cloudfront.net
  1. Verify that your DNS record has propagated and is now pointing to your CloudFront distribution. You can do this by checking the CNAME value at a propagation checker like WhatsMyDNS.

whatsmydns.png

  1. As an additional "sanity check" you can visit your link tracking domain, followed by /health (e.g., https://link.example.com/health). If your domain is properly pointing to our API, the response body will just be {}. Anything else means there is a problem with your configuration.

NOTE: Even if you get a {} response, if anything in your proxy's configuration modifies or misrepresents the referring host, your links may still result in an "Invalid link security token" error. Your proxy server MUST use your link tracking domain as the host header for the requests that are passed to our server.

  1. Finally, once you are sure that your distribution is properly pointing to our API, head back to Customer.io and go to your Workspace Settings for Email. If you haven't already set up your link tracking domain (e.g. link.example.com), enter it now in the HOST NAME field and click the Verify domain button to re-validate the domain. You should now pass the HTTPS check and tracking links will use HTTPS by default.
If past messages already have white-labeled tracked links, changing your link tracking domain will cause those existing tracked links to break.

https_lt_enabled_01.png

When the domain is collapsed/closed, you can tell that HTTPS link tracking is enabled by looking at the LINK TRACKING section pictured below. Once enabled, your tracked links will now start with something like: https://link.example.com...

https_lt_enabled_02.png

Setting up HTTPS Link Tracking with NGINX

Alternatively you can use your own server to serve HTTPS tracked links. The following instructions will guide you through setting up NGINX, however it's possible to use other server software to accomplish this.

  1. Request a new SSL certificate for the domain you want us to use for your tracked links (e.g. link.example.com).

  2. Place the certificate chain into the file named /etc/pki/tls/certs/link.example.com.crt

  3. Place the private key into the file named /etc/pki/tls/private/link.example.com.key

  4. Create the file /etc/nginx/conf.d/link.example.com.conf, with the following content - ensuring that the host header is set to the Host Name specified in your link tracking settings in Customer.io (e.g. link.example.com):

server {
  listen 80;
  listen 443 ssl;
  server_name 'link.example.com';
  ssl_certificate '/etc/pki/tls/certs/link.example.com.crt';
  ssl_certificate_key '/etc/pki/tls/private/link.example.com.key';
  location / {
    proxy_pass 'https://track.customer.io';
    proxy_set_header 'Host' 'link.example.com';
  }
}
  1. Update your DNS record to change the CNAME record for link.example.com to send traffic to your NGINX server. If you're specifying the IP address of your server this will need to be an A record instead of a CNAME record.
  • CNAME or A record host name: link.example.com
  • CNAME or A record value: IP Address of your NGINX server
  1. As an additional "sanity check" you can visit your link tracking domain, followed by /health (e.g., https://link.example.com/health). If your domain is properly pointing to our API, the response body will just be {}. Anything else means there is a problem with your configuration.

NOTE: Even if you get a {} response, if anything in your proxy's configuration modifies or misrepresents the referring host, your links may still result in an "Invalid link security token" error. Your proxy server MUST use your link tracking domain as the host header for the requests that are passed to our server.

  1. Finally, back in Customer.io in your Workspace Settings for Email, if you haven't already set up your link tracking domain (e.g. link.example.com), enter it now in the HOST NAME field and click the Verify domain button to re-validate the domain. You should now pass the HTTPS check and tracking links will use HTTPS by default.
If past messages already have white-labeled tracked links, changing your link tracking domain will cause those existing tracked links to break.

https_lt_enabled_01.png

When the domain is collapsed/closed, you can tell that HTTPS link tracking is enabled by looking at the LINK TRACKING section pictured below. Once enabled, your tracked links will now start with something like: https://link.example.com...

https_lt_enabled_02.png

Was This Article Helpful?