1 - Download the RDS certificates (root plus region-specific intermediate ones) bundle:

```sh
wget -O config/rds-combined-ca-bundle.pem https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem
```

2 - Add `config/rds-combined-ca-bundle.pem` to the repository and redeploy to Heroku.

3 - Update the `DATABASE_URL` env var:

```
'postgres://user:password@host/db_name?sslmode=verify-full&sslrootcert=config/rds-combined-ca-bundle.pem'
```

**do not forget to surround with quotes**

References:

- http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html
- https://www.postgresql.org/docs/9.5/static/libpq-ssl.html#LIBPQ-SSL-PROTECTION