Skip to content
Built on Cloudflare for SaaS

Delegate SSL validation once.
Renew it forever.

DelegatedSSL issues and renews TLS certificates across every client domain you manage — from a single stable _acme-challenge CNAME per domain. Your client delegates once; issuance and renewal keep it green.

Get started See how it works
1CNAME
delegated per domain — set once, never revisited
0renewals
to babysit — issuance and rotation run themselves
∞clients
and team members per tenant — no per-seat fees
app.delegatedssl.com/domains/northwind.co

Domain

northwind.co

awaiting DNS

Add this record at your DNS provider. It is the only change you'll ever make.

Type
CNAME
Host
_acme-challenge.northwind.co
Value
northwind.co.a1b9f0e.dcv.delegatedssl.com
TTL
300
Recheck delegation Copy record

Built for the teams that manage SSL for other people's domains

Digital agenciesManaged service providersWeb hosting resellersDesign & dev studiosPlatform & SaaS teamsWhite-label operatorsSite care & maintenance plansDigital agenciesManaged service providersWeb hosting resellersDesign & dev studiosPlatform & SaaS teamsWhite-label operatorsSite care & maintenance plans

The renewal treadmill

Every certificate you manage is a renewal waiting to break.

Classic ACME makes the domain owner re-prove control on every renewal — a fresh DNS record, an HTTP file, a support ticket, another 3 a.m. "certificate expired" call. Multiply that by a few hundred client domains and it never ends.

  • Expiring TXT tokens the client keeps forgetting to add
  • DNS access you don't have and shouldn't need
  • Outages that surface only when a browser throws a warning

One CNAME. Then silence.

The domain owner points _acme-challenge at DelegatedSSL a single time. Every issuance and renewal after that validates through that stable record — no further action, ever.

Type
CNAME
Host
_acme-challenge.example.com
Value
example.com.a1b9f0e.dcv.delegatedssl.com
Set once · renews automatically · no key handling

How it works

Four steps from unmanaged domain to auto-renewing certificate.

  1. 01

    Delegate the challenge once

    Your client adds a single CNAME — _acme-challenge.example.com pointing at their stable DelegatedSSL target. That's the only DNS change they ever make.

  2. 02

    Add the domain

    Create the domain in your console or via the API. DelegatedSSL registers a Cloudflare for SaaS Custom Hostname and returns the exact delegation record to share.

  3. 03

    Certificate issues automatically

    The moment the CNAME resolves, validation passes and a DV certificate is issued. The domain flips to live — no CSR, no key handling, no waiting on a support queue.

  4. 04

    Renewals run themselves

    Because validation is delegated, every future renewal reuses the same record. Certificates rotate ahead of expiry, and current validation and certificate status is always live in your console.

Walk through the full flow

Everything an agency needs to run SSL as a service.

Not a certbot wrapper — a multi-tenant control plane for delegated validation, automatic issuance and white-label delivery.

Delegate validation once. Renew forever.

Your client adds one CNAME — _acme-challenge.their-domain pointing at DelegatedSSL. From then on every issuance and renewal is validated through that stable record. No per-renewal DNS edits, no expiring TXT tokens, no client back-and-forth.

  • Stable per-domain _acme-challenge CNAME target
  • TXT-method DV validation handled on your behalf
  • Works even when the client's DNS lives elsewhere
  • Delegation status surfaced in real time (pending / verified / error)
Explore delegated dcv
app.delegatedssl.com/domains/northwind.co

Domain

northwind.co

awaiting DNS

Add this record at your DNS provider. It is the only change you'll ever make.

Type
CNAME
Host
_acme-challenge.northwind.co
Value
northwind.co.a1b9f0e.dcv.delegatedssl.com
TTL
300
Recheck delegation Copy record

Cloudflare-grade certificates, issued and rotated for you.

Each domain becomes a Cloudflare for SaaS Custom Hostname on the DelegatedSSL zone. Certificates issue as soon as delegation verifies and rotate automatically ahead of expiry. You watch status — you never handle keys or CSRs.

  • Automatic issuance the moment a domain verifies
  • Hands-off rotation weeks before the 90-day expiry
  • Live cert state: active, pending, expiring, error
  • Issuer, validity window and trace ID on every certificate
Explore certificate lifecycle
app.delegatedssl.com/domains/northwind.co/certificate

Certificate

northwind.co

active

Issuer

Cloudflare · DV

Valid until

Oct 14, 2026

Auto-renews

Sep 14, 2026

Trace ID

req_8f21c…d0

issuedrenewsexpires

One console for every client and every domain.

Organize domains under clients, invite your team with scoped roles, and drive thousands of hostnames from a single organization. Bulk-onboard up to 100 domains at a time and filter by client, validation state or certificate health.

  • Clients → domains hierarchy with tags and notes
  • Owner, admin, operator and viewer roles per member
  • Bulk domain import with per-row accept / reject results
  • Audit log of every domain, key and delegation change
Explore agency multi-tenant
app.delegatedssl.com/domains
189 live 22 pending 3 need action
ClientDomainValidationCertificate
Northwind Studio northwind.co verified active
Northwind Studio shop.northwind.co verified active
Atlas Care Plans atlascare.io pending pending
Meridian Hosting meridian.dev verified renewing
Meridian Hosting cdn.meridian.dev action needed action needed

Send clients a branded page — no login required.

Generate a verification link under your own brand. Your client opens it, sees exactly which CNAME to add, and watches it flip to verified — all without an account. Set your agency name, logo, support email and accent color once and every link inherits it.

  • Shareable, no-login customer verification portal
  • Your logo, color, name and support email on every page
  • Custom domain for the verification experience
  • Copy-ready DCV record with one-click recheck
Explore white-label verification
verify.northwind.co
N Northwind Studio Secured by your agency
verified

shop.northwind.co is secured

Your certificate is live and renews automatically.

Record
_acme-challenge.shop.northwind.co
Status
CNAME detected · validated

Built for automation, isolation and scale.

Bulk onboarding

Paste up to 100 apex domains and DelegatedSSL creates the hostname and delegation record for each, returning a clean accepted / rejected breakdown.

Webhook endpoints

Register HTTPS endpoints and manage rotatable whsec_ signing secrets for lifecycle events like certificate.active and domain.validation_verified.

Scoped API keys

Mint dssl_ keys with least-privilege scopes — domains:read, domains:write, clients:read, reports:read, webhooks:write. Rotate or revoke in one call.

Green reports

An on-demand digest of what's verified, what's pending and what needs a nudge — ready to share with a client.

Row-level isolation

Every query is scoped to your organization by Postgres row-level security. One tenant can never read another's domains, keys or certificates.

Durable rate limiting

Public verification and API traffic are metered by a Cloudflare Durable Object, so limits hold globally — not just per edge location.

API-first

Automate onboarding on top of DelegatedSSL.

The same REST API powers the console. Create a domain, hand the delegation record to your client, and drive your own onboarding on top of DelegatedSSL.

Read the docs Quickstart
POST /v1/domains
# Create a domain — returns the CNAME to delegate
curl https://api.delegatedssl.com/v1/domains \
  -H "Authorization: Bearer dssl_•••" \
  -H "Content-Type: application/json" \
  -d '{"apex":"example.com"}'

→ {
  "apex": "example.com",
  "validation": { "status": "pending",
    "delegation": { "type": "CNAME",
      "host": "_acme-challenge.example.com" } } }

Security & trust

Fails closed. Never fakes "active".

Tenant isolation is enforced in the database, secrets are stored as hashes only, and certificate keys never leave Cloudflare's edge. An unverified domain stays unverified — we don't invent green.

See how we handle security
Certificate authority
Cloudflare for SaaS (DV)
Validation method
Delegated DCV · TXT
Identity
Auth0 (JWT / JWKS)
Data isolation
Postgres row-level security
Transport
HSTS · TLS 1.2+
Secret storage
SHA-256, never plaintext

Pricing

Two plans. Both delegate the same way.

Most popular

Agency

For agencies and studios running SSL across a growing book of client domains.

$79/mo

Get started

Enterprise

For MSPs and platforms operating SSL at scale, with white-label and priority support.

$299/mo

Talk to sales
Compare plans in detail