I always use Cloudflare in front of Heroku; mainly because of that and the cheap & simple SSL set-up that they have.

Do note that Cloudflare is throwing mallware/captcha notices to legitimate users, which is extremely annoying.

When I get such a screen I immediately close the website I'm visiting. And no, contrary to what they tell me, I do not have "a virus" nor is my computer part of a botnet.

Also, careful with Cloudflare SSL. It only secures between the browser and Cloudflare's data center. The connection between your server and Cloudflare remains non-SSL.

You actually have the option to enable SSL both on (customer->cloudflare) and (cloudflare->your server).

And, as I understand it you, you can do:

customer=> Cloudflare SSL

then

cloudflare=> Heroku SSL through Heroku Piggyback