<p>You can provide subdomain entry for client use. eg. Client_x.yourapplication_domain.com. Otherwise, you need to have workaround like putting request forwarder(proxy LB) in front of your application and configure client domain with SSL there. Forward clientdomain.com to Client_x.yourapplication_domain.com. </p>

CC BY-SA 4.0
2019-02-04T09:25:14.750Z
2019-02-04T09:25:14.750Z
Sunil Bhoi
<p>Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not.</p>

<p>One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer makes is to check for ownership of the domain by the entity requesting it.</p>

<p>For "manual" issuers, this often involves uploading a file to a web server on this domain, creating a DNS record or clicking on a link in an email to the registrant, administrator or technical contact in the whois record of the domain.</p>

<p>You can replicate this process for your needs for your SaaS application by using LetsEncrypt: It allows you to either </p>

<ol>
<li>upload a file to a folder on a web server for the domain: In this case you would advise the client to point an A record (or probably better CNAME) to your server and once resolved, you can issue the certificate with letsencrypt by copying the file yourself</li>
<li>create a specific DNS record, which again allows you to create the certificate.</li>
</ol>

<p>Lets encrypt certificates are valid for 90 days, but as you will need the A record in place in anycase to run your SaaS, you will be able to renew the certificate yourself regularly.</p>

<p>P.S.: Not too long ago, subsidiaries of Symantec were found (twice) to not always have checked domain ownership and then did not appear to take remedial action consistently (twice). This led to the "<a href="https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.html" rel="nofollow noreferrer">distrusting</a>" of all Symantec certificates in Chrome and Firefox after giving owners of these certs some time to create new certificates.</p>

CC BY-SA 4.0
2019-05-19T19:00:22.690Z
Thanks for giving me hope! Some elaboration on Let's Encrypt would be excellent.
Gezim
CC BY-SA 4.0
2019-05-20T00:57:49.720Z
Sure, what do you want me to elaborate on, there would be 1000s of LetsEncrypt guides on the Internet
jdog
CC BY-SA 4.0
2019-01-05T08:32:37.647Z
2019-01-05T08:41:59.253Z
2019-01-05T08:41:59.253Z
jdog
<p>We are working on saas application which is hosted on app.example.com. Now we are trying to give the option to the users where their own domain or sub domain like dev.stack.com point to my application by adding A record to 1.2.3.4 IP address (ip address where app.example.com is hosted). </p>

<p>With the above setup, we are facing the issues with ssl certificate of the vendor domains. Is there any way we can create global certificate and add it to our servers which can work for any domain pointed to our servers.</p>

CC BY-SA 4.0
2019-01-07T07:37:17.123Z
You could create a wildcard certificate  *.yourhosting.com and have your customers as customer_x.yourhosting.com
Marged
<nginx><ssl><dns>
Issue with custom domain SSL certification
Aravind Samala
# Issue with custom domain SSL certification

(Asked by: username_0 on 2019-01-04)

We are working on saas application which is hosted on app.example.com. Now we are trying to give the option to the users where their own domain or sub domain like dev.stack.com point to my application by adding A record to 1.2.3.4 IP address (ip address where app.example.com is hosted).

With the above setup, we are facing the issues with ssl certificate of the vendor domains. Is there any way we can create global certificate and add it to our servers which can work for any domain pointed to our servers.

**Tags:** nginx, ssl, dns

> **Comments:**
> **username_1**: You could create a wildcard certificate  *.yourhosting.com and have your customers as customer_x.yourhosting.com  

---

## 2 answers

### Answer by username_3 on 2019-01-05. Score: 1

Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not.

One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer makes is to check for ownership of the domain by the entity requesting it.

For "manual" issuers, this often involves uploading a file to a web server on this domain, creating a DNS record or clicking on a link in an email to the registrant, administrator or technical contact in the whois record of the domain.

You can replicate this process for your needs for your SaaS application by using LetsEncrypt: It allows you to either

1. upload a file to a folder on a web server for the domain: In this case you would advise the client to point an A record (or probably better CNAME) to your server and once resolved, you can issue the certificate with letsencrypt by copying the file yourself
2. create a specific DNS record, which again allows you to create the certificate.

Lets encrypt certificates are valid for 90 days, but as you will need the A record in place in anycase to run your SaaS, you will be able to renew the certificate yourself regularly.

P.S.: Not too long ago, subsidiaries of Symantec were found (twice) to not always have checked domain ownership and then did not appear to take remedial action consistently (twice). This led to the "[distrusting](https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.html)" of all Symantec certificates in Chrome and Firefox after giving owners of these certs some time to create new certificates.

> **Comments:**
> **username_4**: Thanks for giving me hope! Some elaboration on Let's Encrypt would be excellent.  
> **username_3**: Sure, what do you want me to elaborate on, there would be 1000s of LetsEncrypt guides on the Internet  

---

### Answer by username_2 on 2019-02-04. Score: 0

You can provide subdomain entry for client use. eg. Client\_x.yourapplication\_domain.com. Otherwise, you need to have workaround like putting request forwarder(proxy LB) in front of your application and configure client domain with SSL there. Forward clientdomain.com to Client\_x.yourapplication\_domain.com.


---

