Resolved
As of December 22nd at approximately 01:15 UTC we have applied changes to resolve this issue. Affected apps should be resolved automatically as ACM is a continuous process. If a domain does not appear to refresh, an app maintainer can run heroku certs:auto:refresh
via the Heroku CLI, or use the 'Update status' button in the 'Settings' tab of the app on the Heroku Dashboard.
Retroactive
Beginning at approximately 19:40 UTC on December 6th, a configuration change caused some apps using Automated Certificate Management to be unable to generate certificate requests for their domains, and would not receive a new or renewed certificate.
The extent of the change caused the ACM process to be unable to complete, since the process would not fail, notification was never sent. Reviewing the ACM status would list the domains as perpetually in the "Waiting…" state.