Resolved
With the code rollback having taken place we have examined and resolved any remaining Private Space apps with invalid certificate and custom domain associations. This issue has been resolved.
Update
The change that caused this behavior has been reverted, no further apps will be affected by this problem. Engineers have provided a list of affected apps and we are exploring safe resolutions for them now.
Issue
At 20:00 UTC on February 3rd we deployed a change that would add a Default Domain certificate ([app-name].herokuapp.com
) back into Private Space apps that no longer had one. This change was documented in https://devcenter.heroku.com/changelog-items/2023
This change is unable to be made for all apps at once, it has been progressively rolling out to Private Space apps since starting at 20:00 UTC on February 3.
This is causing an issue where Custom Domains that already existed on an app would serve the herokuapp.com certificate instead of an apps' own custom certificate.
Engineers are working to prevent any further impact and evaluate remediation.