We are working on saas application which is hosted on app.example.com. Now we are trying to give the option to the users where their own domain or sub domain like dev.stack.com point to my application by adding A record to IP address (ip address where app.example.com is hosted).

With the above setup, we are facing the issues with ssl certificate of the vendor domains. Is there any way we can create global certificate and add it to our servers which can work for any domain pointed to our servers.

  • You could create a wildcard certificate *.yourhosting.com and have your customers as customer_x.yourhosting.com
    – Marged
    Commented Jan 7, 2019 at 7:37

2 Answers 2


Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not.

One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer makes is to check for ownership of the domain by the entity requesting it.

For "manual" issuers, this often involves uploading a file to a web server on this domain, creating a DNS record or clicking on a link in an email to the registrant, administrator or technical contact in the whois record of the domain.

You can replicate this process for your needs for your SaaS application by using LetsEncrypt: It allows you to either

  1. upload a file to a folder on a web server for the domain: In this case you would advise the client to point an A record (or probably better CNAME) to your server and once resolved, you can issue the certificate with letsencrypt by copying the file yourself
  2. create a specific DNS record, which again allows you to create the certificate.

Lets encrypt certificates are valid for 90 days, but as you will need the A record in place in anycase to run your SaaS, you will be able to renew the certificate yourself regularly.

P.S.: Not too long ago, subsidiaries of Symantec were found (twice) to not always have checked domain ownership and then did not appear to take remedial action consistently (twice). This led to the "distrusting" of all Symantec certificates in Chrome and Firefox after giving owners of these certs some time to create new certificates.

  • Thanks for giving me hope! Some elaboration on Let's Encrypt would be excellent.
    – Gezim
    Commented May 19, 2019 at 19:00
  • Sure, what do you want me to elaborate on, there would be 1000s of LetsEncrypt guides on the Internet
    – jdog
    Commented May 20, 2019 at 0:57

You can provide subdomain entry for client use. eg. Client_x.yourapplication_domain.com. Otherwise, you need to have workaround like putting request forwarder(proxy LB) in front of your application and configure client domain with SSL there. Forward clientdomain.com to Client_x.yourapplication_domain.com.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.