Changes to Common Runtime *.herokuapp.com domain apps

Change effective on 24 August 2026

Heroku made these changes to Common Runtime apps with a default *.herokuapp.com domain:

Updated Accepted Ciphers for TLS Termination

Apps with the default *.herokuapp.com domain and custom domains now support the same ciphers. See HTTP Routing for a list of supported ciphers.

Heroku no longer supports these ciphers:

TLS_ECDHE-ECDSA-AES128-SHA256
TLS_ECDHE-RSA-AES128-SHA256
TLS_ECDHE-ECDSA-AES128-SHA
TLS_ECDHE-RSA-AES128-SHA
TLS_ECDHE-ECDSA-AES256-SHA384
TLS_ECDHE-RSA-AES256-SHA384
TLS_ECDHE-RSA-AES256-SHA
TLS_ECDHE-ECDSA-AES256-SHA
TLS_AES128-SHA256
TLS_AES128-SHA
TLS_AES256-SHA256
TLS_AES256-SHA

TLS 1.3 Client Support

Previously, apps with a *.herokuapp.com domain only supported TLS 1.2. Now, they support both TLS 1.2 and 1.3 protocols.

Connect with HTTP/2

Apps with a *.herokuapp.com domain can now connect with HTTP/2. See HTTP Routing for more information on using HTTP/2 on the Common Runtime.