Where should I store sensitive files on Heroku?
You can set the whole certificate in an environment variable.
See this answer:Multi-line config variables in Heroku
You might consider storing the cert in S3 which can be downloaded by each process at startup and stored in memory (or memcached/redis) for subsequent access.
If you're really feeling it you might consider creating your own buildpack which does the cert download at slug compile time and makes it available on the slug filesystem.
For me the best solution was to encrypt the private keys in the certificate and store the password for decryption in Herokus environment variables.