Skip to content

Product

A control plane for delegated validation and automated SSL.

Four capabilities do the heavy lifting: delegate validation once, let certificates issue and renew themselves, run every client from one tenant, and hand clients a page that's branded as you.

Delegated DCV

Delegate validation once. Renew forever.

Your client adds one CNAME — _acme-challenge.their-domain pointing at DelegatedSSL. From then on every issuance and renewal is validated through that stable record. No per-renewal DNS edits, no expiring TXT tokens, no client back-and-forth.

  • Stable per-domain _acme-challenge CNAME target
  • TXT-method DV validation handled on your behalf
  • Works even when the client's DNS lives elsewhere
  • Delegation status surfaced in real time (pending / verified / error)
app.delegatedssl.com/domains/northwind.co

Domain

northwind.co

awaiting DNS

Add this record at your DNS provider. It is the only change you'll ever make.

Type
CNAME
Host
_acme-challenge.northwind.co
Value
northwind.co.a1b9f0e.dcv.delegatedssl.com
TTL
300
Recheck delegation Copy record

Certificate lifecycle

Cloudflare-grade certificates, issued and rotated for you.

Each domain becomes a Cloudflare for SaaS Custom Hostname on the DelegatedSSL zone. Certificates issue as soon as delegation verifies and rotate automatically ahead of expiry. You watch status — you never handle keys or CSRs.

  • Automatic issuance the moment a domain verifies
  • Hands-off rotation weeks before the 90-day expiry
  • Live cert state: active, pending, expiring, error
  • Issuer, validity window and trace ID on every certificate
app.delegatedssl.com/domains/northwind.co/certificate

Certificate

northwind.co

active

Issuer

Cloudflare · DV

Valid until

Oct 14, 2026

Auto-renews

Sep 14, 2026

Trace ID

req_8f21c…d0

issuedrenewsexpires

Agency multi-tenant

One console for every client and every domain.

Organize domains under clients, invite your team with scoped roles, and drive thousands of hostnames from a single organization. Bulk-onboard up to 100 domains at a time and filter by client, validation state or certificate health.

  • Clients → domains hierarchy with tags and notes
  • Owner, admin, operator and viewer roles per member
  • Bulk domain import with per-row accept / reject results
  • Audit log of every domain, key and delegation change
app.delegatedssl.com/domains
189 live 22 pending 3 need action
ClientDomainValidationCertificate
Northwind Studio northwind.co verified active
Northwind Studio shop.northwind.co verified active
Atlas Care Plans atlascare.io pending pending
Meridian Hosting meridian.dev verified renewing
Meridian Hosting cdn.meridian.dev action needed action needed

White-label verification

Send clients a branded page — no login required.

Generate a verification link under your own brand. Your client opens it, sees exactly which CNAME to add, and watches it flip to verified — all without an account. Set your agency name, logo, support email and accent color once and every link inherits it.

  • Shareable, no-login customer verification portal
  • Your logo, color, name and support email on every page
  • Custom domain for the verification experience
  • Copy-ready DCV record with one-click recheck
verify.northwind.co
N Northwind Studio Secured by your agency
verified

shop.northwind.co is secured

Your certificate is live and renews automatically.

Record
_acme-challenge.shop.northwind.co
Status
CNAME detected · validated

Platform

Automation primitives, built in.

Bulk onboarding

Paste up to 100 apex domains and DelegatedSSL creates the hostname and delegation record for each, returning a clean accepted / rejected breakdown.

Webhook endpoints

Register HTTPS endpoints and manage rotatable whsec_ signing secrets for lifecycle events like certificate.active and domain.validation_verified.

Scoped API keys

Mint dssl_ keys with least-privilege scopes — domains:read, domains:write, clients:read, reports:read, webhooks:write. Rotate or revoke in one call.

Green reports

An on-demand digest of what's verified, what's pending and what needs a nudge — ready to share with a client.

Row-level isolation

Every query is scoped to your organization by Postgres row-level security. One tenant can never read another's domains, keys or certificates.

Durable rate limiting

Public verification and API traffic are metered by a Cloudflare Durable Object, so limits hold globally — not just per edge location.

Webhook events

domain.createddomain.validation_verifieddomain.validation_errorcertificate.activecertificate.blockedverification_link.openedverification_link.completed

API key scopes

domains:readdomains:writeclients:readclients:writereports:readwebhooks:write

Team & access

Four roles, scoped to what each person should touch.

Owner

Full control of the organization, billing and every domain, client and key.

Admin

Manage domains, clients, team, API keys and webhooks — everything except billing ownership.

Operator

Create and verify domains and request issuance, without access to keys or team settings.

Viewer

Read-only visibility into domains, certificates and reports for stakeholders.

Get started Read the docs