SSL for SaaS: certificates for customer domains
On Growth and up, each customer domain gets a certificate on its first HTTPS request, renewed without DNS access.
For CTOs and platform engineers at platforms such as Supabase, GitHub Pages and Render.
| Type | Host | Value | State |
|---|---|---|---|
| CNAME | shop.acme.com | edge.customdomain.ai | live |
- Status
- issued
- Issuer
- R11
- Expires
- 2026-12-30
- Renews from
- 2026-11-30
What breaks today
| What breaks | What your customer sees |
|---|---|
| A renewal job that stops | Every certificate has an end date, so a missed renewal is an outage. |
| CAA record without Let's Encrypt | Issuance fails for the whole zone after the DNS write succeeds. |
| Issuing for any host that points at you | Without a gate, anyone can point a name at you and trigger issuance. |
| Expiry nobody sees | The first report comes from the customer's visitors. |
How CustomDomain™ handles it
| Step | What CustomDomain™ does |
|---|---|
| Issues on first request | Growth and up Once the domain is live or propagating and points at the edge. |
| Gates every host | A host with no live or propagating connection gets no certificate. |
| Renews on its own | About 30 days before expiry, with no DNS access needed. |
| Retries a failed renewal | The current certificate keeps serving while renewal is retried. |
| Warns before expiry | Webhooks and email at 14, 7 and 3 days. |
| Limit | On Starter and Startup, domains point at your servers and the certificate is yours. |
Where your customers' DNS is hosted
Six common providers and the way in each one offers.
| DNS provider | Way in today |
|---|---|
| Cloudflare | sign in |
| NameSilo | one-click |
| GoDaddy | api key |
| Amazon Route 53 | api key |
| Namecheap | by hand |
| Squarespace | by hand |
Common questions
What is SSL for SaaS?
Serving HTTPS on each customer's own domain, with a certificate issued and renewed for every host name. On Growth and up, the CustomDomain™ edge does this on the first HTTPS request.
Does my customer add a TXT record for the certificate?
No. The edge validates through the domain itself once it points at CustomDomain™, and renewal needs no DNS access.
How do I know a certificate needs attention?
Webhooks and email warn at 14, 7 and 3 days before an unrenewed certificate expires, and the console shows the certificate's state, dates and last error.
Supabase, GitHub Pages, Render, Let's Encrypt and other names on this page are trademarks of their owners. CustomDomain™ is not affiliated with or endorsed by them. Facts about other products were read from their public pages on October 30, 2026.
Put your customers on their own domains.
Your first ten domains connect free. No card needed to sign up.