Heroku Labs: Change Automated Certificate Management Keys

Last updated October 23, 2026

Automated Certificate Management (ACM) can issue certificates with a Rivest-Shamir-Adleman (RSA) key or an Elliptic Curve Digital Signature Algorithm (ECDSA) key.

  • RSA (default): ACM issues certificates with an RSA key by default. If ACM doesn’t issue your certificates with an RSA key, enable the Heroku Labs acm-rsa-cert feature.
  • ECDSA: To have ACM issue certificates with an ECDSA key instead of the default RSA key, enable the Heroku Labs acm-ec-cert feature.

Features added through Heroku Labs are experimental and may change without notice. These features are non-SFDC applications. Refer to your Main Services Agreement for additional information.

Overview

Enabling one of the features changes only the certificates that ACM issues, such as:

  • Common Runtime apps: Certificates for custom domain apps with ACM enabled. It doesn’t change certificates on default herokuapp.com domain apps.
  • Fir Private Space apps: Certificates for custom domains and the default domain.
  • Cedar-generation Private Space and Shield Private Space apps: Doesn’t change these apps’ certificates. ACM keeps issuing RSA certificates even with this feature enabled.
  • Certificates you upload yourself: Doesn’t change these apps’ certificates.

Check a Domain’s Key Type

To see which key type a domain’s certificate has, run this OpenSSL command. Replace www.example.com with your domain:

$ openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -text | grep "Public Key Algorithm"

A certificate with an RSA key prints Public Key Algorithm: rsaEncryption. A certificate with an ECDSA key prints Public Key Algorithm: id-ecPublicKey.

RSA Key

By default, ACM issues certificates with an RSA key. It’s not necessary to enable the acm-rsa-cert feature unless you enabled acm-ec-cert to issue certificates with an ECDSA key.

After enabling the acm-rsa-cert feature, ACM issues your app’s certificates with a 2048-bit RSA key instead of an ECDSA key. The feature takes priority over the acm-ec-cert feature and over Heroku’s default key type.

When the change takes effect:

  • A certificate that ACM issues after enabling the feature, such as one for a custom domain, has an RSA key.
  • An existing ECDSA certificate keeps its ECDSA key until ACM issues the next certificate for that domain. For example, when it renews the certificate one month before it expires. Until ACM issues the new certificate, the domain keeps serving its current one.

To see when a custom domain’s certificate expires, run heroku certs and check the Expires column:

$ heroku certs -a example-app
 Name            Common Name(s)                   Expires               Trusted  Type
 ────────────── ───────────────────────────────── ───────────────────── ──────── ───
 example-81798   example-app.runtime.herokai.com  2026-12-30 23:39 UTC  True     ACM

Each domain serves one certificate. If a domain’s certificate already switched to ECDSA, clients that don’t support ECDSA can’t connect to it over Hypertext Transfer Protocol Secure (HTTPS). The switch back to RSA happens when ACM issues the next domain certificate, often weeks after you enable the feature. To switch sooner, contact Heroku Support. If your app’s clients don’t support ECDSA, enable the feature before your app’s certificates switch.

Enable

To have ACM issue RSA certificates for your app, enable the feature with the command:

$ heroku labs:enable acm-rsa-cert -a example-app

Disable

To stop ACM from issuing RSA certificates for your app if you enabled the acm-ec-cert feature, disable the acm-rsa-cert feature with the command:

$ heroku labs:disable acm-rsa-cert -a example-app

If the acm-ec-cert feature is enabled, ACM then issues ECDSA certificates. A certificate that already has an RSA key keeps it until ACM issues the next certificate for that domain, for example when it renews the certificate.

ECDSA Key

After enabling the acm-ec-cert feature, ACM issues your app’s certificates with an ECDSA key instead of a 2048-bit RSA key. The ECDSA key uses the P-256 elliptic curve.

When the change takes effect:

  • A certificate that ACM issues after enabling the feature, such as one for a custom domain, has an ECDSA key.
  • An existing RSA certificate keeps its RSA key until ACM issues the next certificate for that domain. For example, when it renews the certificate one month before it expires. Until ACM issues the new certificate, the domain keeps serving its current one.

To see when a custom domain’s certificate expires, run heroku certs and check the Expires column:

$ heroku certs -a example-app
 Name            Common Name(s)                   Expires               Trusted  Type
 ────────────── ───────────────────────────────── ───────────────────── ──────── ───
 example-81798   example-app.runtime.herokai.com  2026-12-30 23:39 UTC  True     ACM

Each domain serves one certificate. After a domain’s certificate switches to ECDSA, clients that don’t support ECDSA can’t connect to it over Hypertext Transfer Protocol Secure (HTTPS). The switch happens when ACM issues the next domain certificate, often weeks after you enable the feature. Disabling the feature switches back only when ACM issues the next certificate. Before enabling, make sure your app’s clients support ECDSA.

Enable

To have ACM issue ECDSA certificates for your app, enable the feature with the command:

$ heroku labs:enable acm-ec-cert -a example-app

Disable

To have ACM go back to issuing RSA certificates for your app, disable the feature with the command:

$ heroku labs:disable acm-ec-cert -a example-app

A certificate that already has an ECDSA key keeps it until ACM issues the next certificate for that domain, for example when it renews the certificate.