How it works

Supersonic speeds.
Global edge network.

How SSLforSaaS delivers automated SSL at the edge — for every custom domain on your platform, without manual intervention.

Create Account Explore the flow
1On-demand SSL 2Setting up 3Management 4Infrastructure 5FAQ

The full lifecycle

Less work, more productivity

From customer DNS configuration to provider-backed active status, with every state visible in the app.

1
DNS points to CNAME
Your customer adds a CNAME record pointing their domain to your branded SSLforSaaS endpoint.
2
DNS validated
SSLforSaaS and the edge provider evaluate the customer record against the project-specific target.
3
Certificate issued
Cloudflare manages certificate issuance while SSLforSaaS exposes the current provider-backed state.
4
HTTPS active
Traffic is seamlessly routed to your application endpoint, now fully encrypted over HTTPS.
01 — On-demand SSL

Managed SSL for every connected domain

SSLforSaaS uses Cloudflare's edge network to provision and serve certificates for customer domains connected to your project. Your customers add the DNS record shown in the app; SSLforSaaS tracks validation, certificate, and routing status from there.

For example, a customer can point www.customerdomain.com to the project-specific target shown by SSLforSaaS while requests are forwarded to your application at app.saas.com. Keep existing traffic in place until the app reports the new hostname as active.

Use the assigned target: Every project receives its own DNS target and status instructions. Do not use a shared sample hostname or IP address for production setup.
Provider-backed status
Managed TLS lifecycle
Customer DNS handoff
Project-specific target
! www.customerdomain.com HTTP — Not Secure http traffic SSLforSaaS Edge Proxy Network Managed edge Detecting unsecured domain... Let's Encrypt ZeroSSL Certificate issued in 4.2s www.customerdomain.com HTTPS ✓ TLS 1.3 Active Your Application app.saas.com proxied CERTIFICATE STATUS domain: *.customerdomain.com status: active ✓ issuer: Let's Encrypt tls: TLSv1.3 issued: 4.2s expires: 2026-07-09
02 — Setup

A guided path from endpoint to DNS target

After creating your account, enter the application endpoint that should receive customer requests, select a catalog-backed plan, and complete hosted checkout. Provisioning then creates a project-specific CNAME target.

Project Settings shows the exact target to share with customers. Subdomains point to it with CNAME; apex domains require a DNS provider that supports ALIAS, ANAME, or CNAME flattening.

Customer-facing experience: Customers browse their own domain while its DNS record points to the project-specific target shown in the app.
Endpoint validation
Hosted checkout
Project CNAME target
Visible provisioning status
SSLforSaaS — Setup Wizard 1 APPLICATION ENDPOINT Where should we send your customer traffic? app.saas.com Verify → 2 PROJECT DNS TARGET Customers will point their domain here ssl.saas.com ✓ CONFIGURATION COMPLETE — Share with your customers: DNS Type: CNAME → ssl.saas.com DNS Type: A Record → project.sslforsaas.io SETUP PROGRESS 90%
03 — Management

Full control from a single dashboard

Once your setup is live, the app shows the state of every connected domain. You can update the application endpoint and configure project request forwarding without selecting or uploading certificate authorities.

Need to route specific traffic differently? Attach multiple custom headers with dynamic values, or configure URL rewrites to match your application's routing logic.

Project webhooks: Subscribe to supported lifecycle events so your application can react to domain and certificate state changes.
Lifecycle status
Project webhooks
Custom headers + rewrites
Scoped API keys
Auto-renewal lifecycle
Dashboard Domains Settings Logs Webhooks API Keys Domains — 3 active + Add domain app.acmecorp.com Let's Encrypt · TLSv1.3 · Expires 2026-07-12 Active portal.nexuscorp.io ZeroSSL · TLSv1.3 · Expires 2026-08-03 Active dash.vertexhq.com Provisioning certificate... Issuing... CERTIFICATE AUTHORITY Let's Encrypt ZeroSSL App endpoint: app.saas.com Cloudflare proxy: RENEWAL MODE MANAGED provider-backed lifecycle Renewal state remains visible Next renewal: 2026-06-12 RECENT ACTIVITY app.acmecorp.com — cert renewed successfully 2m ago dash.vertexhq.com — cert issuance in progress now

04 — Infrastructure

Performance and reliability as a standard

SSLforSaaS combines Cloudflare-backed edge services with persisted project and domain state so lifecycle progress remains visible instead of being inferred from marketing timers.

Provider-backed edge
Cloudflare handles the edge and custom-hostname lifecycle while SSLforSaaS records the provider state for each customer domain.
Managed certificate lifecycle
Cloudflare manages certificate issuance and renewal. SSLforSaaS exposes the provider-backed status so you can wait for an active hostname before directing customer traffic.
TLS 1.3 by default
Every certificate is provisioned with TLS 1.3 — the fastest and most secure transport standard. No configuration required. It's simply the default.
Cloudflare-backed edge
Each project receives explicit DNS instructions for its assigned Cloudflare-backed target. Provider-specific DNS constraints remain visible during validation.
Real-time webhooks
Subscribe to supported project events and verify signed delivery. Transient failures follow the worker retry policy.
Operational status visibility
The app exposes persisted project and domain state plus provider-backed lifecycle details without inventing an uptime guarantee.
4 plans
Catalog-backed capacity
Published domains and request limits
Tracked
Certificate status
From DNS validation to active
Scoped
Project API access
Explicit key permissions

FAQ

Common questions

Have a question not covered here? Reach out to our team.

Timing depends on DNS propagation and provider validation. The app keeps the current status visible until the hostname and certificate are active.
Subdomains can use the CNAME target shown in the app. Apex domains require a DNS provider that supports ALIAS, ANAME, or CNAME flattening. In every case, the domain owner must add the required DNS record.
No self-service certificate upload is exposed today. The current public project API focuses on project-scoped domain provisioning, status, metrics, and webhook events.
Use the project-specific target shown in Project Settings. Customers point their own subdomain to that value; do not substitute a shared sample target.
Keep the existing route in place until the app reports the new hostname and certificate as active. Cutting DNS over before that state can interrupt traffic.
Cloudflare manages certificate renewal. SSLforSaaS surfaces lifecycle state and supported webhook events without promising a fixed renewal day.
SSLforSaaS is platform-agnostic and works with any SaaS product that supports custom domains — e-commerce platforms, content platforms, live chat tools, marketing platforms, forum software, website builders, and more. If your customers can point a domain to your application, SSLforSaaS can secure it.
Ready to start?

SSL lifecycle control for
every customer domain.

Give us your application endpoint, use the project-specific CNAME target, and follow the provider-backed lifecycle state until the domain is active.

Create Account Read API Docs