Changes to how Automated Certificate Management retries failing certificates

Change effective on 10 November 2026

Starting November 11, 2026, Automated Certificate Management (ACM) changes how it retries certificate renewals for custom domains.

  • When a custom domain fails a check, for example because its DNS isn’t set up, ACM waits at least 6 hours before it tries again. To retry sooner, use the heroku certs:auto:refresh command.
  • After 7 days without a valid certificate and ACM still can’t issue one, ACM stops trying the domain. It sends a reminder about once a week while the domain stays in this state.

To get a certificate, fix the domain’s setup by pointing it at the DNS target that heroku domains shows. Then, run the command to try again:

$ heroku certs:auto:refresh -a example-app

For each failure reason and how to fix it, see the Troubleshooting section for ACM.