install custom TLS cert + contact Heroku support to drop TLS 1.0/1.1 for fussy client