Or, if you want to just provision a letsencrypt certificate on Heroku without cloudflare:
Is it possible to create a new certificate without restarting all the servers each time a new client signs up?
You'd have to store them in a database for example to avoid having to restart the app. But that wouldn't be a good solution either, as letsencrypt will not allow you to have more than 100 domains under the same certificate.