Let's Encryptの証明書ちゃんと自動更新してくれてました
$ :| openssl s_client -connect mastodon.zunda.ninja:443 -servername mastodon.zunda.ninja -showcerts 2>/dev/null | openssl x509 -noout -text | grep 'Not '
Not Before: Jun 14 23:27:00 2017 GMT
Not After : Sep 12 23:27:00 2017 GMT
https://devcenter.heroku.com/articles/automated-certificate-management