On paid dynos, Heroku's Automatic Certificate Management (ACM) handles certificate issuance and renewal for custom domains with no manual steps — enable it under your app's Settings → Domains.
Manual certificate installation
If you need to use a specific certificate (an EV certificate, for example, which ACM doesn't provide since it only issues free domain-validated certificates), you can upload one manually via the Heroku CLI: heroku certs:add yourcert.pem yourkey.pem, using Heroku's SSL add-on if you're not already on a plan tier that includes it.
What to do if your custom domain shows a certificate error despite ACM being enabled
If Automated Certificate Management shows as enabled but a certificate error persists, checking your domain's DNS configuration against Heroku's specific documented requirements (a CNAME pointing to your Heroku DNS target) usually reveals a DNS misconfiguration blocking certificate issuance.
How Heroku's router affects what your application needs to know about HTTPS
Because Heroku's router terminates TLS before forwarding requests to your application dyno as plain HTTP, your application code needs to check the X-Forwarded-Proto header rather than performing a direct HTTPS check, following the same pattern covered in our dedicated Node.js, Django, and Rails redirect guides.
What the difference is between Heroku's SSL Endpoint addon and Automatic Certificate Management
Heroku's older SSL Endpoint addon required manually purchasing and uploading a certificate; Automatic Certificate Management, the current standard approach, provisions and renews Let's Encrypt certificates automatically at no additional cost — ACM is the recommended approach for any current Heroku deployment.
How to add multiple custom domains to a single Heroku app
Heroku supports adding multiple custom domains to one app through the Domains section of app settings, with ACM automatically provisioning a certificate covering each added domain individually as it's connected and DNS-verified.
Why Heroku's free tier historically had different SSL capabilities than paid tiers
Older Heroku free tier plans had more limited custom domain SSL support than paid dynos historically — checking your current plan's specific SSL feature support against Heroku's current documentation clarifies whether an upgrade is genuinely required for your specific use case.
What to do if ACM shows an error status rather than completing successfully
An ACM error status typically includes a specific reason directly in the Heroku dashboard or CLI output — most commonly a DNS configuration issue, checking the exact error message against Heroku's documented troubleshooting guidance resolves the majority of ACM provisioning failures.
How Heroku Pipelines handle SSL configuration across different deployment stages
Each app within a Heroku Pipeline (review, staging, production) maintains its own independent domain and SSL configuration — promoting code through a pipeline doesn't automatically carry over domain or certificate settings, which need to be configured separately for each stage's specific app.
A closing note on Heroku's balance between simplicity and control
Heroku's Automatic Certificate Management strikes a reasonable balance for most applications — considerably simpler than manual certificate management, while still giving you meaningful visibility and control through the CLI when something does need direct attention.
A final practical tip worth adding to your routine
Reviewing Heroku's own changelog periodically helps catch any platform-level changes to ACM or domain handling before they unexpectedly affect your application, since Heroku, like any managed platform, does occasionally revise how these underlying features work.