Managed custom-domain SSL

Effortless SSL
Management

Connect customer domains to a project-specific DNS target, track provider-backed SSL lifecycle state, and forward active traffic to your configured endpoint.

Create Account See how it works
Lifecycle state Visible
AVG SPEED
Tracked
PROJECT DNS TARGET
Assigned

Built for SaaS teams managing customer domains

Managed SSL Project API Origin routing Webhooks Usage billing Lifecycle status
4 plans
Catalog-backed capacity
Tracked
Provider-backed lifecycle
Live
Provider-backed certificate status

How it works

Managed SSL without certificate queues

A guided path from endpoint validation to provider-backed domain activation.

DNS Configuration NAME TYPE VALUE @ A 93.184.216.34 *.app CNAME project.sslforsaas.io mail MX mail.provider.com CNAME propagated · TTL 300s
Configure your CNAME
Set up a single CNAME record in your DNS. Your customers point their custom domains to it — that's the only setup required on your end.
domain *.app.com Let's Encrypt ZeroSSL CERT TLS 1.3 ✓ Provider managed
Automatic certificate issuance
The moment a domain points to your CNAME, SSLforSaaS detects it and starts provider-backed certificate provisioning and reports each state in the app.
Issue Serve Renew Monitor AUTO ∞ 90 days auto-renew
Lifecycle fully managed
Renewals, reissuance, revocations — all handled automatically. Your team is free to build product, not manage certificate queues.

Zero-touch security

Enterprise-grade SSL, without the enterprise pain

Your customers get branded, secure domains. You get zero support tickets about certificate errors.

  • Managed certificate renewals
    Cloudflare manages certificate issuance and renewal while SSLforSaaS exposes provider-backed status.
  • TLS 1.3 by default
    The newest, fastest transport security standard — automatically applied to every domain.
  • Global edge infrastructure
    Globally distributed PoPs ensure the fastest provisioning response from anywhere in the world.
TLS 1.3 Let's Encrypt Primary CA ZeroSSL Backup CA app.client1.com portal.client2.io dash.client3.com secure.client4.net PROVIDER STATE ACTIVE RENEWAL MODE MANAGED STATUS SOURCE Tracked
SSLforSaaS Project API # Provision SSL certificate POST /workspaces/{w}/projects/{p}/domains Authorization: Bearer {PROJECT_API_KEY} Content-Type: application/json {"domain": "app.yourcustomer.com" } SEND → 202 ACCEPTED · ASYNC { "status": "active" "domain": "app.yourcustomer.com" "tls_version": "TLSv1.3" "valid_until": "2026-06-28T09:41:26Z" } ENDPOINTS POST /workspaces/{w}/projects/{p}/domains Queue domain GET /workspaces/{w}/projects/{p}/domains/{d} Certificate status DEL /workspaces/{w}/projects/{p}/domains/{d} Delete domain GET /workspaces/{w}/projects/{p}/domains List all domains

Developer-first API

Integrate through one project-scoped API

A clean project-scoped REST API with webhooks and practical docs. Everything your engineers need to connect customer domains safely.

  • Project-scoped REST API
    Use project API keys with scoped domain and metrics routes. Public SDKs are not required for the first integration path.
  • Webhook events
    Subscribe to the current domain, SSL issue, limit, provisioning-failure, and user-action event catalog.
  • OpenAPI specification
    Full OpenAPI 3.0 spec available. Import directly into Postman or generate your own client.

Pricing

Simple, scalable pricing

Start free, scale as your customers grow. No hidden fees, no per-certificate charges.

Save 20%

All plans include managed SSL provisioning, project-scoped API access, and provider-backed lifecycle status. Extra domains are billed monthly.

Lite
$20/mo*
Up to 100 custom domains
Automatic SSL provisioning
Managed certificate renewals
Project-scoped REST API
Custom origin routing
$0.50 / extra domain
Get started
Basic
$47/mo*
Up to 300 custom domains
Everything in Lite
Project webhook events
Project metadata
54M requests / month
$0.30 / extra domain
Get started
Standard
$71/mo*
Up to 500 custom domains
Everything in Basic
Custom request headers
Path rewrites
79M requests / month
$0.25 / extra domain
Create account
Enterprise
$199/mo*
Up to 1,500 custom domains
Everything in Standard
1,500 included domains
219M requests / month
SSO entitlement
$0.20 / extra domain
Contact sales
Lite
$20/mo*
Up to 100 custom domains
Automatic SSL provisioning
Managed certificate renewals
Project-scoped REST API
Custom origin routing
$0.50 / extra domain
Get started
Basic
$47/mo*
Up to 300 custom domains
Everything in Lite
Project webhook events
Project metadata
54M requests / month
$0.30 / extra domain
Get started
Most popular
Standard
$71/mo*
Up to 500 custom domains
Everything in Basic
Custom request headers
Path rewrites
79M requests / month
$0.25 / extra domain
Create account
Enterprise
$199/mo*
Up to 1,500 custom domains
Everything in Standard
1,500 included domains
219M requests / month
SSO entitlement
$0.20 / extra domain
Contact sales

* Billed annually. Monthly equivalent shown.

app.client.com ✓ portal.eu.io ✓ dash.asia.co ✓ secure.br.com ✓ app.au.net ✓ Project-scoped lifecycle visibility
Why SSL matters

SSL is no longer optional —
it's the baseline your customers expect.

HTTPS is a baseline expectation for customer-facing domains. SSLforSaaS gives SaaS teams one project-scoped workflow for domain onboarding, lifecycle visibility, and origin routing.

app.yourclient.com ✓ SSL TLS active
Customer trust & conversions
A valid certificate avoids browser security warnings and gives customers the expected HTTPS connection on branded domains.
IN TRANSIT EDGE TLS HTTPS TLS 1.3 256-bit
Encrypted transport
TLS protects data in transit, but transport encryption alone does not certify your product for any regulatory framework.
https://app.yourclient.com G #1 app.yourclient.com ✓ HTTPS #2 competitor.com ✓ HTTPS #8 nossl.com ⚠ Not Secure +SEO
SEO & search ranking
Google has used HTTPS as a ranking signal since 2014. Browsers show a "Not Secure" warning on HTTP domains — killing organic traffic instantly.
Issue Serve Renew Watch AUTO ∞
Certificate expiry risk
An expired certificate can interrupt a customer domain. Managed renewal and visible lifecycle state reduce that risk but still require monitoring.
acme.com Secure ✓ portal.io Secure ✓ app.saas.com Secure ✓
Your customers' brand reputation
A browser security warning on your customer's domain reflects on their brand — and yours. SSL keeps every branded domain credible.
POST /workspaces/{w}/projects/{p}/domains domain: "app.customer.com" 200 status: "active" · provider-backed Catalog limits · visible state
Scale without the overhead
Managing SSL manually across hundreds of customer domains is a full-time job. One API call, fully automated — your team ships features instead.