Skip Navigation
Show nav
Heroku Dev Center
  • Get Started
  • Documentation
  • Changelog
  • Search
  • Get Started
    • Node.js
    • Ruby on Rails
    • Ruby
    • Python
    • Java
    • PHP
    • Go
    • Scala
    • Clojure
  • Documentation
  • Changelog
  • More
    Additional Resources
    • Home
    • Elements
    • Products
    • Pricing
    • Careers
    • Help
    • Status
    • Events
    • Podcasts
    • Compliance Center
    Heroku Blog

    Heroku Blog

    Find out what's new with Heroku on our blog.

    Visit Blog
  • Log inorSign up
View categories

Categories

  • Heroku Architecture
    • Dynos (app containers)
    • Stacks (operating system images)
    • Networking & DNS
    • Platform Policies
    • Platform Principles
  • Command Line
  • Deployment
    • Deploying with Git
    • Deploying with Docker
    • Deployment Integrations
  • Continuous Delivery
    • Continuous Integration
  • Language Support
    • Node.js
    • Ruby
      • Working with Bundler
      • Rails Support
    • Python
      • Background Jobs in Python
      • Working with Django
    • Java
      • Working with Maven
      • Java Database Operations
      • Working with the Play Framework
      • Working with Spring Boot
      • Java Advanced Topics
    • PHP
    • Go
      • Go Dependency Management
    • Scala
    • Clojure
  • Databases & Data Management
    • Heroku Postgres
      • Postgres Basics
      • Postgres Getting Started
      • Postgres Performance
      • Postgres Data Transfer & Preservation
      • Postgres Availability
      • Postgres Special Topics
    • Heroku Data For Redis
    • Apache Kafka on Heroku
    • Other Data Stores
  • Monitoring & Metrics
    • Logging
  • App Performance
  • Add-ons
    • All Add-ons
  • Collaboration
  • Security
    • App Security
    • Identities & Authentication
    • Compliance
  • Heroku Enterprise
    • Private Spaces
      • Infrastructure Networking
    • Enterprise Accounts
    • Enterprise Teams
    • Heroku Connect (Salesforce sync)
      • Heroku Connect Administration
      • Heroku Connect Reference
      • Heroku Connect Troubleshooting
    • Single Sign-on (SSO)
  • Patterns & Best Practices
  • Extending Heroku
    • Platform API
    • App Webhooks
    • Heroku Labs
    • Building Add-ons
      • Add-on Development Tasks
      • Add-on APIs
      • Add-on Guidelines & Requirements
    • Building CLI Plugins
    • Developing Buildpacks
    • Dev Center
  • Accounts & Billing
  • Troubleshooting & Support
  • Integrating with Salesforce
  • Security
  • App Security
  • Understanding SSL on Heroku

Understanding SSL on Heroku

English — 日本語に切り替える

Last updated January 07, 2023

Table of Contents

  • When to use Automated Certificate Management (ACM)
  • When to use Heroku SSL

There are two ways to enable SSL for your Heroku app’s custom domains (listed in order of recommended use):

  • Automated Certificate Management (ACM)
  • Heroku SSL

In general, your app should use Automated Certificate Management unless it requires functionality that ACM does not support. Summaries for the functionality provided by each method are provided below.

For enabling SSL on apps in Private Spaces, please refer to the documentation here.

SSL is always enabled for .herokuapp.com for Common Runtime apps.

When to use Automated Certificate Management (ACM)

With Automated Certificate Management (ACM), Heroku automatically manages TLS certificates for apps running on paid dynos on the Common Runtime. Certificates handled by ACM automatically renew one month before they expire, and new certificates are created automatically whenever you add or remove a custom domain.

ACM is recommended for most Heroku apps, because:

  • It provides TLS certificates at no additional cost
  • It supports creating certificates for multiple domains
  • It automatically renews TLS certificates before they expire

ACM does not provide support for:

  • Wildcard domains
  • OV/EV certificates
  • Apps using internal routing
  • Eco dyno apps

If your app requires any of the functionality that ACM doesn’t support, it should use Heroku SSL instead.

DNS Targets for ACM

DNS targets for ACM will end with herokudns.com for Common Runtime apps, or herokuspace.com for Private Spaces apps e.g.

example.com        example.com.herokudns.com
www.example.com    www.example.com.herokudns.com

or

example.com        random-word-odhsycy1xdsqfbqy8gceaa2d.herokudns.com

or for Private Spaces

example.com        random-haiku-5196.also-random-3847.herokuspace.com

Again, wildcard domains are not supported by ACM.

When to use Heroku SSL

Heroku SSL is a free service for apps running on paid dynos that allows you to upload your own TLS certificate. You are responsible for purchasing and renewing this certificate.

Use Heroku SSL instead of Automated Certificate Management (ACM) if:

  • You want to use an OV/EV certificate
  • Your app needs to support wildcard domains
  • Your app uses internal routing

Heroku SSL uses Server Name Indication (SNI), an extension of the TLS protocol.

DNS Targets for Heroku SSL

DNS targets for Heroku SSL follow these patterns:

example.com        example.com.herokudns.com
www.example.com    www.example.com.herokudns.com
*.example.com      wildcard.example.com.herokudns.com

Keep reading

  • App Security

Feedback

Log in to submit feedback.

WebSocket Security WebSocket Security

Information & Support

  • Getting Started
  • Documentation
  • Changelog
  • Compliance Center
  • Training & Education
  • Blog
  • Podcasts
  • Support Channels
  • Status

Language Reference

  • Node.js
  • Ruby
  • Java
  • PHP
  • Python
  • Go
  • Scala
  • Clojure

Other Resources

  • Careers
  • Elements
  • Products
  • Pricing

Subscribe to our monthly newsletter

Your email address:

  • RSS
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku Blog
    • Heroku News Blog
    • Heroku Engineering Blog
  • Heroku Podcasts
  • Twitter
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku
    • Heroku Status
  • Facebook
  • Instagram
  • Github
  • LinkedIn
  • YouTube
Heroku is acompany

 © Salesforce.com

  • heroku.com
  • Terms of Service
  • Privacy
  • Cookies
  • Cookie Preferences