A wildcard cert wouldn't cover both heroku.com and herokuapps.com anyway. https://en.wikipedia.org/wiki/Wildcard_certificate