Perhaps 1 out of 100 visitors to Connect for a Cause were getting an 'untrusted certificate' error, where if you clicked the Technical Details button, it said the error code was sec_error_unknown_issuer
Usually, if your certificate isn't trusted, it isn't trusted. You usually don't get 99% of your traffic through without any warning. I kept telling people that I thought their browser may had cached something from an earlier time when we (read: they) had a legitimate issue with the certificate. Then, I was playing around on my linux box, and I hit the site, and boom -- This Connection is Untrusted.
So, right when I took over at Connect, I bought a wildcard cert from DNSimple and followed the Heroku SSL Endpoint Documentation to add the certificate and key I was given through the DNSimple web application to my heroku domains. Easy enough, and things were working for me and everyone el