Note that StavrosK is probably talking about SSL client authentication, which isn't what most people think about when talking about SSL. Basically, it enables you to allow access only to people with a certain client certificate installed in their browser (i.e., proving the clients' identity to the server, not just the other way around).

Unfortunately I have no idea how this would work on Heroku.

There's a great article about client authentication for HAProxy (might be interesting even if you're not using HAProxy): http://blog.exceliance.fr/2012/10/03/ssl-client-certificate-...