Heroku provides free, automatically managed SSL certificates for custom domains on paid dynos via Automatic Certificate Management (ACM), removing manual certificate installation from the process entirely.
Enabling ACM
Under your app's Settings → Domains, enable Automatic Certificate Management — Heroku handles issuance and renewal from that point on, provided your domain's DNS is correctly pointed at Heroku.
Enforcing the redirect
Heroku itself doesn't force the redirect automatically — that's handled at the application level, the same way as any framework running elsewhere. See the Node.js/Express, Django, or Rails guides in this category depending on your stack; the same middleware or settings approach applies whether you're deployed on Heroku or elsewhere, checking X-Forwarded-Proto since Heroku's router terminates TLS in front of your app.
Why Automatic Certificate Management still leaves the redirect itself up to you
Heroku's ACM feature handles certificate issuance and renewal automatically, but doesn't itself enforce an HTTPS redirect — that's handled at the application level using the same framework-specific approach (Express, Django, Rails) covered elsewhere in this category, checking the forwarded-protocol header since Heroku's router terminates TLS before your app receives the request.
What Heroku's router does to the connection before your app ever sees it
Heroku's routing layer terminates TLS and forwards plain HTTP to your application dyno, setting the X-Forwarded-Proto header to indicate the original protocol — your application code needs to check this header rather than performing a direct HTTPS check, which would always read as false given this architecture.
What Heroku's free tier historically meant for HTTPS on custom domains
Older Heroku free tier plans had more limited custom domain SSL support than paid dynos — if you're on an older or free plan and encountering unexpected limitations, checking your current plan's specific SSL feature support against Heroku's current documentation clarifies whether an upgrade is in practice required.
What Heroku's Config Vars can do to manage environment-specific redirect behavior
Using Heroku Config Vars to store environment-specific values, distinguishing a staging app from production, lets your application's redirect and HTTPS-related logic behave appropriately differently across environments without hardcoding environment-specific values into your application code.
How Heroku Pipelines affect testing this configuration across environments
Heroku Pipelines, letting you promote a build from staging through to production, ensure the exact same tested code (including your HTTPS redirect middleware) moves through each environment consistently, reducing the risk of environment-specific configuration drift affecting your redirect logic.
Why reviewing Heroku's changelog periodically helps catch platform-level changes
Platform-level changes to how Heroku's router or Automatic Certificate Management behaves are documented in Heroku's official changelog — periodically reviewing it helps catch a platform-side change that might affect your existing HTTPS configuration before it causes an unexpected issue.
What the Heroku CLI can show you about your current SSL and domain configuration
Running heroku certs:info and heroku domains through the Heroku CLI shows your app's current certificate status and configured domains directly from the command line, useful for quickly checking configuration without navigating the web dashboard.
How this guide's steps apply the same way across Heroku's different language runtimes
Heroku's Automatic Certificate Management and router-level TLS termination operate identically regardless of whether your app runs Node.js, Ruby, Python, or any other supported language — only the application-level redirect middleware implementation differs by language, following the framework-specific guides elsewhere in this category.
Loading comments…