0

I have my SaaS application running on AWS. Customers use their own domains and point their domain to my domain like:

hosted.example.com

Now hosted.example.com is running on Route 53 and points to my ELB.

Is there a way I can provide SSL certificates for my customers?

Keep in mind I want this to be a scalable idea, so say I have 100K customer domains pointing to my service.

Improve this question

2 Answers 2

Reset to default
1

You can create certificates using ACM for ELB. However, these certificates are not designed for your use case.

  • ACM: Number of domains per certificate: 10
  • ACM: Number of certificates: 100
  • ELB: Certificates per load balancer: 25

Using the above numbers as maximums you could only service 250 domains per ELB. Given that for most domain names you will want both "mydomain.com" and "*.mydomain.com" this reduces the number to 125 domain names.

ACM Limits

Improve this answer
4
  • If I ran my application off of ec2 instances that I manage, and install the certifications on nginx, would that be more scalable?
    – cool breeze
    Feb 6, 2018 at 20:42
  • I cannot comment on nginx. Amazon Certificate Manager only works with Amazon services. For nginx you will need to find another certificate authority. Let's Encrypt is very popular but I don't think that you can bundle a large number of domain names into their certificates. For 100K domains you will probably need to become your own certificate authority or purchase certificates. I think your strategy is flawed - when I think of the processing horsepower to look up certificate names (100K of them) for each web request ....
    – John Hanley
    Feb 6, 2018 at 21:00
  • I noticed this other large Saas, and the SSL certs they give out say Lets Encrypt Authority X3.
    – cool breeze
    Feb 6, 2018 at 22:02
  • @coolbreeze yes, that's an option, too. Let's Encrypt works with essentially any platform, but it does require closer monitoring due to its relatively short certificate life cycle. With SNI and SSL handled on your servers, directly (not offloading it to ELB/ALB), there should not be a meaningful limit to the number of certs your platform can support.
    – Michael - sqlbot
    Feb 7, 2018 at 0:02
0

Cloudflare has an option for enterprise customers that perfectly matches your use case. https://support.cloudflare.com/hc/en-us/articles/217371987-Managing-Custom-Hostnames-SSL-for-SaaS-

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .