Keep Heroku ACM Working Behind a Static Inbound IP

Your Heroku app can use a static inbound IP while keeping certificate management at the origin. That makes certificate troubleshooting part of the proxy setup. Heroku's latest ACM change gives teams a reason to review that process.

This matters when requests reach your Heroku app through an inbound proxy. If you're using QuotaGuard only for outbound API calls, this announcement concerns a different traffic path.

Heroku Now Spaces Failed ACM Checks at Least Six Hours Apart

Heroku's November 10, 2026 announcement says the rollout starts November 11. After a custom domain fails a check, ACM waits at least six hours before trying again. A manual refresh can request an earlier attempt.

After seven days without a valid certificate, if issuance still fails, ACM stops trying that domain. Heroku sends reminders roughly weekly while it remains in that state.

The useful takeaway: fixing a configuration doesn't mean an automatic attempt happens immediately. Check the result after requesting a refresh.

Shield Keeps the Certificate at Heroku

QuotaGuard's Heroku inbound guide documents the distinction: Shield passes TLS through to Heroku, while Static terminates inbound TLS at QuotaGuard.

With Shield, the certificate at Heroku serves the connection. When ACM manages that certificate, its validation and renewal process matters directly to your inbound service.

With Static and your own custom domain, you upload the certificate to QuotaGuard. Heroku ACM doesn't renew that uploaded certificate. Keep its maintenance separate from any certificate used by your Heroku origin.

Choose the product around where you want TLS to terminate. Both products support inbound and outbound traffic. Here, the important difference is who presents the certificate.

Check the Failing Domain Before Requesting Another Attempt

Start with the affected app and hostname. Collect its ACM status, certificate details, and configured Heroku domain target:

heroku certs:auto -a example-app
heroku certs -a example-app
heroku domains -a example-app

Replace example-app with your app's name. These checks help separate a certificate issuance failure from a routing problem.

Heroku's ACM troubleshooting documentation covers DNS, challenge forwarding, CAA restrictions, and rate limits. Use the reported failure reason to choose your next step.

For a proxied domain, review the complete route: public hostname, QuotaGuard inbound configuration, and Heroku destination. Don't replace your working proxy DNS records with a direct Heroku target just because a general troubleshooting example shows one. That would change the path you're trying to preserve.

Ask QuotaGuard support to check the domain target and challenge path if the required configuration isn't clear. A valid certificate on one hostname doesn't prove another hostname is ready. Test the hostname your customers actually use.

Refresh ACM After the Fix, Without Resetting It

Once you've corrected the underlying issue, Heroku documents this command to request another attempt:

heroku certs:auto:refresh -a example-app

A refresh requests issuance. It doesn't guarantee success or override a certificate authority's rate limits. Recheck ACM status afterward.

Heroku explicitly warns against turning ACM off and back on to fix or accelerate issuance. Disabling ACM removes its certificate and can contribute to Let's Encrypt rate limits. Keep ACM enabled while addressing the reported cause.

If you're updating a team runbook, make the sequence explicit: inspect, fix, refresh, verify. Leave certificate removal out of a routine retry procedure.

Confirm HTTPS Works Through the Intended Inbound Route

Finish with a customer-facing check through your public hostname. Confirm that the expected certificate is served and that the request reaches the intended application.

Keep the DNS and proxy configuration you checked with the result. That gives your team a useful reference for the next domain change or certificate renewal.

QuotaGuard Static Direct Pricing Starts at $19/Month

QuotaGuard Static direct plans include bandwidth and a static IP pair per subscription. For custom-domain inbound HTTPS, you manage the certificate uploaded to QuotaGuard. Lower tiers use shared static IPs. Dedicated IPs are included on Enterprise plans and above.

QuotaGuard Shield Direct Pricing Starts at $29/Month

QuotaGuard Shield direct plans provide SSL passthrough when you want TLS to terminate at the destination. For a Heroku app using ACM, that keeps the certificate at Heroku. These are direct-signup prices, not the Heroku Marketplace entry tiers.

Compare QuotaGuard plans and pricing. If you're choosing an inbound setup, contact us with your hostname, Heroku domain target, and the ACM error. We can help you review the right configuration before you change it.