Inactive expired SSL certificates will be cleaned up after one month
Change effective on 10 April 2014
As noted in the SSL documentation, inactive expired certificates will be cleaned up after one month.
heroku certs:update is run, the existing certificate is made inactive, and is retained for roll-back purposes. When these inactive certificates expire, they will now be removed after a one month period. This will not impact active certificates, or inactive certificates which are still valid.