How to design TLS for SaaS custom domains at scale

A SaaS custom domain is a lifecycle:

customer types hostname → you store a row → they prove ownership → you issue → you deliver the leaf to the listener that already has SNI for that tenant → you mark HTTPS ready → you renew without another marketing page.

sslcertificates.io custom hostnames: POST /api/v1/custom-hostnames returns ownership_token (own_…) and cname_target. Statuses are pending → certificate_pending → active. There is no public POST /custom-hostnames/{id}/validate. Do not invent it.

DNS drift is the hidden failure: the customer deletes the TXT or moves the CNAME after go-live. Renewal then fails. Webhook certificate.renewal_failed must update the tenant table, not only a Slack channel.

Provider neutrality matters only where it is true. We do not require a CDN cutover. We also do not claim Cloudflare SSL for SaaS as a live-verified platform product until a disposable account has completed E2E.