Why is my domain stuck in the 'Waiting' state for ACM?
Try waiting for a day or two and run a single
heroku certs:auto:refresh, or by clicking the 'Refresh Status' button on the Dashboard for your app. If you still run into this problem, contact support rather than trying to resolve it by performing any of the above actions. We also recommend against enabling/disabling ACM as a troubleshooting step because this resets our internal rate limit which could result in you hitting Let's Encrypt's limit, which means you would have to wait for a week to try again.