0

I have my SaaS application running on AWS. Customers use their own domains and point their domain to my domain like:

hosted.example.com

Now hosted.example.com is running on Route 53 and points to my ELB.

Is there a way I can provide SSL certificates for my customers?

Keep in mind I want this to be a scalable idea, so say I have 100K customer domains pointing to my service.

1

You can create certificates using ACM for ELB. However, these certificates are not designed for your use case.

  • ACM: Number of domains per certificate: 10
  • ACM: Number of certificates: 100
  • ELB: Certificates per load balancer: 25

Using the above numbers as maximums you could only service 250 domains per ELB. Given that for most domain names you will want both "mydomain.com" and "*.mydomain.com" this reduces the number to 125 domain names.

ACM Limits

  • If I ran my application off of ec2 instances that I manage, and install the certifications on nginx, would that be more scalable? – cool breeze Feb 6 '18 at 20:42
  • I cannot comment on nginx. Amazon Certificate Manager only works with Amazon services. For nginx you will need to find another certificate authority. Let's Encrypt is very popular but I don't think that you can bundle a large number of domain names into their certificates. For 100K domains you will probably need to become your own certificate authority or purchase certificates. I think your strategy is flawed - when I think of the processing horsepower to look up certificate names (100K of them) for each web request .... – John Hanley Feb 6 '18 at 21:00
  • I noticed this other large Saas, and the SSL certs they give out say Lets Encrypt Authority X3. – cool breeze Feb 6 '18 at 22:02
  • @coolbreeze yes, that's an option, too. Let's Encrypt works with essentially any platform, but it does require closer monitoring due to its relatively short certificate life cycle. With SNI and SSL handled on your servers, directly (not offloading it to ELB/ALB), there should not be a meaningful limit to the number of certs your platform can support. – Michael - sqlbot Feb 7 '18 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.