1 - Download the certificate with:
`wget -O config/rds-combined-ca-bundle.pem https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem`

2 - Add the certificate file to the repository and redeploy to Heroku.

3 - Update the `DATABASE_URL` env var by appending `?sslmode=verify-full&sslrootcert=config/rds-combined-ca-bundle.pem`

References:

- http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html
- https://www.postgresql.org/docs/9.5/static/libpq-ssl.html#LIBPQ-SSL-PROTECTION