I have a web app, and when users sign up, we give them their own subdomain, e,g, user1.website.example

We do this with a wildcard ssl for *.website.example

However, users are requesting custom domains.

So we plan on letting them point a CNAME to our system.

So when the user creates a CNAME "register.user1website.example" points to "user1.website.example", we pull that CNAME from the db and server the correct content - all works hunky dory...

BUT How do we allow the users domain to have a SSL?

Our system auto redirects from http to https, so they would get an insecure warning. Obviously, for the moment we have stopped the redirect, but we want everyone to have a SSL.

We're also talking about 10k+ users, so I don't want to have to have the domain added into Plesk and Lets Encrypt, as it changes all the time, and it would be a nightmare for management.

I especially don't want to have to manually add domains and SSLs in our plesk panel whenever someone wants to add a custom domain.

I have looked into SAN SSLs, but they only allow up to 100 domains - is there another method I can use that will serve me better?

  • You need to have certificates with all the names for which you have HTTPS links. You can put multiple names in a single certificate, or have one certificate per name, but there are no other options. Since the customer has a CNAME towards your infrastructure, you should have no problem using http-01 validation method to issue certificates per name and then maintain them. – Patrick Mevzek May 8 '20 at 3:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.