Skip to content

How it works

Delegate the challenge once. Everything after that is automatic.

Under the hood, DelegatedSSL creates a Cloudflare for SaaS Custom Hostname for each domain and points validation at a stable per-domain _acme-challenge record. Here's the whole flow.

01

Delegate the challenge once

Your client adds a single CNAME — _acme-challenge.example.com pointing at their stable DelegatedSSL target. That's the only DNS change they ever make.

app.delegatedssl.com/domains/northwind.co

Domain

northwind.co

awaiting DNS

Add this record at your DNS provider. It is the only change you'll ever make.

Type
CNAME
Host
_acme-challenge.northwind.co
Value
northwind.co.a1b9f0e.dcv.delegatedssl.com
TTL
300
Recheck delegation Copy record
02

Add the domain

Create the domain in your console or via the API. DelegatedSSL registers a Cloudflare for SaaS Custom Hostname and returns the exact delegation record to share.

app.delegatedssl.com/domains
189 live 22 pending 3 need action
ClientDomainValidationCertificate
Northwind Studio northwind.co verified active
Northwind Studio shop.northwind.co verified active
Atlas Care Plans atlascare.io pending pending
Meridian Hosting meridian.dev verified renewing
Meridian Hosting cdn.meridian.dev action needed action needed
03

Certificate issues automatically

The moment the CNAME resolves, validation passes and a DV certificate is issued. The domain flips to live — no CSR, no key handling, no waiting on a support queue.

app.delegatedssl.com/domains/northwind.co/certificate

Certificate

northwind.co

active

Issuer

Cloudflare · DV

Valid until

Oct 14, 2026

Auto-renews

Sep 14, 2026

Trace ID

req_8f21c…d0

issuedrenewsexpires
04

Renewals run themselves

Because validation is delegated, every future renewal reuses the same record. Certificates rotate ahead of expiry, and current validation and certificate status is always live in your console.

app.delegatedssl.com/domains/meridian.dev

Renewal schedule

meridian.dev

  1. Delegated & issued

    Jul 16, 2026 · via _acme-challenge CNAME

  2. Renewal scheduled

    Sep 14, 2026 · reuses same delegation

  3. Auto-renew & rotate

    no DNS change required

Certificates rotate weeks before the 90-day expiry — nothing for you or your client to do.

Under the hood

What actually happens on our side

  1. A Custom Hostname is created on the DelegatedSSL zone

    Each domain becomes a Cloudflare for SaaS Custom Hostname with TXT-method DV validation — the smallest, safest payload, nothing extra.

  2. A stable delegation record is derived

    We return the exact _acme-challenge CNAME the domain owner should publish — the same record for every future renewal.

  3. Validation is polled and reflected

    As the CNAME resolves, validation flips from pending to verified, and the certificate moves to active. If something's off, you get a precise error — never a fake green.

  4. Renewals reuse the delegation

    Because control is delegated, rotation needs no new DNS. Certificates renew ahead of the 90-day expiry automatically.

Delegate your first domain API quickstart