Custom hostnames
Custom domains without building certificate infrastructure.
A customer types app.customer.com. You inherit ownership proof, DNS, validation, issuance, delivery, renewal and failure handling. This page is the product for that job — provider-neutral, not a required CDN cutover.
The path a hostname actually takes
- Customer adds a hostname in your product.
- You call
POST /api/v1/custom-hostnames. Status startspending. - You show
ownership_token(own_…) and a traffic CNAME.cname_targetisedge.sslcertificates.iounless you replace it with your edge. - Ownership is marked validated →
certificate_pending. There is no publicPOST /custom-hostnames/{id}/validate. - You issue with
POST /api/v1/certificatesfor that name. - You deploy or deliver PEM to the terminator you already run.
- Hostname becomes
activewhen a certificate is attached. - Auto-renew follows
next_renewal_at. Webhooks report issued, renewed or renewal_failed.
Why Cloudflare’s product is the SERP competitor — and not our architecture
Search for “SSL for SaaS” and “custom hostname certificates” is dominated by Cloudflare for SaaS. Their docs split hostname validation and certificate validation, warn that leftover TXT breaks renewal, and can terminate traffic on their edge. We keep the same split — ownership token ≠ ACME challenge — and we do not require you to move traffic onto an anycast network we operate. Differentiation is infrastructure neutrality and lifecycle control (inventory, webhooks, optional deploy/verify), only where those implementations exist.
Failure handling
- Typo’d CNAME, leftover
_acme-challengeTXT, CAA that forbids the chosen CA, HTTP-01 hidden behind a proxy. - Renewal is when DNS drift shows up — not signup.
certificate.renewal_failedshould open an in-app task on the tenant, not only an email.- Rate-limit retries so a stuck wizard cannot burn Let’s Encrypt duplicate limits for that registered domain.
| status | certificate_pending |
|---|---|
| ownership_token | own_demo_not_a_secret |
| cname_target | edge.sslcertificates.io |
| next action | POST /certificates for this hostname |
Search intent this page owns
SSL for SaaS, SaaS custom domains SSL, custom domain TLS, custom hostname certificates, white-label domain SSL. The Certificate API page owns the REST contract. The SaaS solution page is the operating manual. Academy explains the protocol. This page is the commercial product.
Related Solutions and Integrations
Solutions this product surface is built for:
Customer-facing integrations to open next:
Questions people actually ask
How do I add a customer domain?
POST /api/v1/custom-hostnames with the hostname. Show the customer ownership_token and the traffic CNAME. Issue with POST /certificates after ownership is believable. Deliver PEM to your terminator.
Is edge.sslcertificates.io my CDN?
No. It is the instructional cname_target. Replace it in your UI if your edge target is different. We do not require a cutover onto a CDN we operate.
How is this different from Cloudflare for SaaS?
Cloudflare’s custom-hostname product lives inside the Cloudflare ecosystem and can terminate traffic there. This platform is provider-neutral: ownership + issuance + webhooks, then you keep the edge you already run. We do not claim Cloudflare’s anycast or hostname pricing model.
Which webhooks fire for hostnames?
Certificate events: issued, renewed, renewal_failed, revoked, plus order.created and validation_required. Poll GET /custom-hostnames/{id} for ownership status. Do not invent a hostname webhook that is not in the API.
What statuses exist?
Created pending. After ownership is marked validated: certificate_pending. After a certificate is attached: active. Academy also describes ownership_validation and renewing as operator-facing language.
Do customers move their whole DNS zone?
No. They publish the records you asked for. Do not require a zone transfer. Leftover _acme-challenge TXT next to a delegation CNAME is a common renewal break.
Can I use DNS-01 for customer zones?
Yes when you have a Cloudflare token for that zone, or when the customer publishes the TXT. HTTP-01 works when the name already reaches an origin you control.
Is there a validate endpoint on the hostname?
No public POST /custom-hostnames/{id}/validate. Do not invent it.
Ship custom domains without staffing ACME.
Create the hostname record first so your UI can render instructions. Issue only when ownership is believable.