SSL Certificate for domains we do not own

Question

We have a cloud based SaaS multi-tenancy system. AKA: the platform. The platform provides the service to our customers by allowing their end users to perform some work. To give an example, imagine we have a blogging service we sell to companies and they can then post blogs and engage with their users on it.

To date, in order to somewhat whitelable the service and be able to do so securely, we bought, for each customer, a domain and issued an SSL certificate for it (Domain Validation on a UCC certificate). E.g. if we have a customer called corporate1, we would usually buy a domain called blogcorporate1.com and manage it.

We want to fully whitelable the solution meaning we want to be able to serve our customers from blog.corporate1.com.

Is there a way to do it?

Can this be done is such a way where we can be completely be independent from the customer? Meaning, if they simply redirect to our service and we change our server to a different IP then we need them to point to the new IP.

Can they delegate the management of the subdomain blog.corporate1.com to us and we'll manage the zone for that sub domain as well as issue SSL certificate for it (also set email forwarding and other DNS things we do)?

Answer 1

Depending on what SSL certificate you want for these domains, you could request a domain validated certificate that only requires you to be in control of the specified sub.domain.tld.

A good example these days would be let's encrypt. As long as the hostname is pointing to your server you can request a certificate.

certbot-auto certonly --webroot -d blog.domain.tld -w /var/www/blog.domain.tld

Answer 2

There are several questions here, which is not great practice for SF. That said, as I understand it, you have a customer, let's call them example.com, and you want to provide them a blog service on blog.example.com, using SSL.

They host the DNS. What if our server IP changes?

They update their DNS to advertise your new IP, and things keep on working.

Could they delegate the blog.example.com subdomain to our nameservers?

Yes, provided they have some DNS clue, and a half-decent DNS infrastructure. Then you could schedule IP changes without reference to the client.

Can I get an SSL certificate for blog.example.com?

If this was generally possible to do, it would completely defeat the whole idea of SSL. Some providers will regard control of HTTP service on blog.example.com as proving that you have the right to an SSL certificate with that CN (as lalokin points out in his/her answer, letsencrypt is one such provider), so that once you have http://blog.example.com set up and working, you could get a certificate from such a provider. Some CAs want more proof that you're entitled to use the FQDN (eg, control of a running mailserver on blog.example.com) and if (say) the client wants an EV certificate things will get more complex quite quickly.

The generally-valid solution here is to generate a CSR, give it to the client, and tell them to get it signed by any provider that suits them. Once they give you the signed certificate, you install it, and SSL ensues.