Straightforward pricing for SSL at agency scale.
Both plans delegate validation the same way and renew automatically. Pick Agency to get going, or Enterprise when you need unlimited domains and a custom-domain portal.
Most popular
Agency
For agencies and studios running SSL across a growing book of client domains.
$79/mo
Get started- Up to 250 active domains
- Unlimited clients & team members
- Delegated DCV + automatic renewals
- White-label verification links
- Scoped API keys & webhooks
- Weekly green reports
- Audit log & role-based access
- Email support
Enterprise
For MSPs and platforms operating SSL at scale, with white-label and priority support.
$299/mo
Talk to sales- Unlimited domains
- Everything in Agency, plus:
- Custom-domain verification portal
- Higher API rate limits
- Priority support & onboarding
- Bulk import & migration assistance
- Volume domain pricing
- Security & compliance review
Monthly pricing in USD. Get started on Agency and delegate your first client domain end to end.
Compare every detail
| Feature | Agency · $79/mo | Enterprise · $299/mo |
|---|---|---|
| Domains & scale | ||
| Active domains | Up to 250 | Unlimited |
| Clients | Unlimited | Unlimited |
| Team members | Unlimited | Unlimited |
| Bulk onboarding (per request) | 100 | 100 |
| Certificates & validation | ||
| Delegated DCV | Included | Included |
| Automatic issuance & renewal | Included | Included |
| Wildcard certificate support | Included | Included |
| Certificate metadata & trace IDs | Included | Included |
| White-label & branding | ||
| Branded verification links | Included | Included |
| Custom-domain verification portal | Not included | Included |
| Agency logo, color & support email | Included | Included |
| Platform & API | ||
| Scoped API keys | Included | Included |
| Webhooks (HMAC-signed) | Included | Included |
| Audit log | Included | Included |
| API rate limit | Standard | Elevated |
| Support | Priority + onboarding | |
Questions, answered
How is this different from just using ACME / certbot?
With classic ACME you (or your client) has to satisfy a fresh DNS-01 or HTTP-01 challenge on every renewal. DelegatedSSL delegates the challenge to a single stable CNAME, so the domain owner acts once and every renewal after that is automatic. You never chase expiring TXT records again.
Does my client have to move their DNS to Cloudflare?
No. Their DNS can live anywhere. They only add one _acme-challenge CNAME pointing at DelegatedSSL. That single record delegates validation without touching the rest of their zone.
Who issues the certificate?
Certificates are issued and rotated through Cloudflare for SaaS as domain-validated (DV) certificates. DelegatedSSL orchestrates the Custom Hostname, delegation and lifecycle so you only ever see status.
Do you ever handle private keys?
No. Certificate material is managed by Cloudflare for SaaS at the edge. DelegatedSSL exposes certificate metadata — issuer, validity, status and trace IDs — but never exports private keys.
Can I automate with an API?
Yes. The same REST API that powers the console is at api.delegatedssl.com — create domains, fetch delegation records, verify delegation, request issuance and manage webhook endpoints and API keys. See the developer docs.
How do I get started?
Create your organization, add a client domain, and share the one delegation CNAME. Once it resolves, the certificate issues automatically. Agency is a self-serve plan; Enterprise starts with a scoped onboarding call.
Still deciding?