This might be an issue with - "purchased certificate must be combined with a root CA certificate for it to be trusted by browsers", see https://devcenter.heroku.com/articles/ssl-certificate i think it is an nginx thing? And definitly do NOT disable ssl