Change effective on 10 April 2014
As noted in the SSL documentation, inactive expired certificates will be cleaned up after one month.
heroku certs:update is run, the existing certificate is made inactive, and is retained for roll-back purposes. When these inactive certificates expire, they will now be removed after a one month period. This will not impact active certificates, or inactive certificates which are still valid.