Cloudflare SSL for SaaS: $0 Multi-Tenant Custom Domains

The Manual Infrastructure Nightmare of B2B Multi-Tenant SaaS: Custom Domains and SSL Provisioning

When building B2B enterprise SaaS applications like Notion, Shopify, Vercel, Framer, or Typeform, you quickly face an explosive demand from customers (tenants) wanting to map their custom brand domains (app.customer-company.com) to your SaaS platform.

However, the traditional AWS NGINX Reverse Proxy + Certbot (Let’s Encrypt) + AWS ACM cluster architecture leads to infrastructure management hell and runaway costs as your customer base scales from 100 to 1,000+ tenants.

1. NGINX Configuration Bloat & Memory Spikes: Every new custom domain adds another server { listen 443; server_name app.customer.com; ... } block, causing NGINX process memory usage to scale non-linearly.
2. Certbot 90-Day Renewal Failures: Automating SSL renewals for 1,000+ domains frequently triggers rate limit violations or DNS validation errors, resulting in critical NET::ERR_CERT_DATE_INVALID warnings on customer domains.
3. Hefty AWS Load Balancer & EC2 Bills: Running ALB target groups and EC2 clusters to handle SSL handshakes drains $300–$1,500 every single month.

[The Manual B2B Multi-Tenant SaaS Custom Domain Nightmare]
Customer Domain (app.customer.com) -> AWS NGINX Certbot Cluster ($650/mo overhead) -> SSL Expiration Outages
                                      * Manual NGINX edits & non-stop 90-day renewal monitoring required!

In 2025/2026, the modern edge architecture that completely eliminates this manual overhead is the Cloudflare Custom Hostnames (SSL for SaaS) & Workers Fallback Origin pipeline.

Customers simply point a CNAME record to your Fallback Origin Worker (fallback.my-saas.com). The Cloudflare API automatically issues a Let’s Encrypt / Google Trust Services TLS certificate at the edge within 5 seconds, serving custom domains at $0 SSL management overhead.

This guide walks you through the inner mechanics of Cloudflare SSL for SaaS, building a Fallback Origin Worker, automating provisioning via the Custom Hostnames REST API, dynamically binding tenants using custom_metadata, and performance/cost benchmarks.

Cloudflare Custom Hostnames (SSL for SaaS) Hybrid Architecture

Your customers add just a single CNAME record, while Cloudflare edge nodes handle TLS handshakes and tenant routing automatically.

+-----------------------------------------------------------------------------------+
| Cloudflare Custom Hostnames (SSL for SaaS) Multi-Tenant Routing Pipeline         |
+-----------------------------------------------------------------------------------+

[Customer Domain: app.customer-company.com (CNAME -> fallback.my-saas.com)]
                                       |
                                       v
[Cloudflare Edge SNI / SSL Handshake (Dynamic 5-second TLS Provisioning)]
                                       |
                    [Fallback Origin Worker Edge Runtime]
                                       |
        +-------------------------------+-------------------------------+
        |                                                               |
  (A) customHostnameMetadata Detected                           (B) Tenant DB 0.1ms Lookup
    - tenant_id: "tenant_corp_992"                                - Serves custom theme per customer
    - custom_domain: "app.customer-company.com"                   - Data isolation & routing
        |                                                               |
        +-------------------------------+-------------------------------+
                                       |
                                       v
                 [$0 SSL Management Fee & 100% Automated SaaS Response]

1. Fallback Origin Worker Setup: Register a single edge origin Worker (fallback.my-saas.com) to receive traffic from all tenant custom domains.
2. Dynamic Custom Hostnames API Provisioning: The instant a customer registers a domain in your dashboard, the Cloudflare API requests a Let’s Encrypt / Google Trust Services certificate, issued at the edge in 5 seconds.
3. Edge Detection via customHostnameMetadata: Tenant metadata (tenant_id, custom_theme) is injected into the Worker during the TLS handshake (c.req.raw.cf?.customHostnameMetadata), achieving instant multi-tenant routing without NGINX reloads.

Step 1: Implement Dynamic Custom Hostname Registration API (src/custom_domain_service.ts)

Implement an API route that calls the Cloudflare REST API to register custom hostnames and request SSL certificates whenever a customer adds a domain in your SaaS dashboard.

// src/custom_domain_service.ts
import { Hono } from "hono";

type Env = {
  Bindings: {
    CF_ZONE_ID: string;
    CF_API_TOKEN: string;
    FALLBACK_ORIGIN: string; // e.g. fallback.my-saas.com
  };
};

const app = new Hono<Env>();

// 1. Register custom domain & trigger automated 5-second SSL issuance
app.post("/api/v1/domains/register", async (c) => {
  const { customDomain, tenantId, theme } = await c.req.json<{
    customDomain: string;
    tenantId: string;
    theme: string;
  }>();

  const zoneId = c.env.CF_ZONE_ID;
  const apiToken = c.env.CF_API_TOKEN;

  // Call Cloudflare Custom Hostnames REST API
  const response = await fetch(
    `https://api.cloudflare.com/client/v4/zones/${zoneId}/custom_hostnames`,
    {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${apiToken}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        hostname: customDomain,
        ssl: {
          method: "http", // HTTP / CNAME automated validation
          type: "dv",     // Domain Validated (Let's Encrypt / Google Trust)
          settings: {
            min_tls_version: "1.2",
            http2: "on",
          },
        },
        // 2025/2026 Core Feature: Tenant metadata injected directly into Edge Worker
        custom_metadata: {
          tenant_id: tenantId,
          theme_mode: theme,
          created_at: new Date().toISOString(),
        },
      }),
    }
  );

  const result = await response.json();
  if (!response.ok) {
    return c.json({ error: "Failed to register custom hostname", details: result }, 400);
  }

  // 2. Return CNAME instructions to the customer
  return c.json({
    success: true,
    customDomain: customDomain,
    cnameTarget: c.env.FALLBACK_ORIGIN,
    status: result.result.status, // pending_validation -> active
    verificationTxt: result.result.ownership_verification?.text_name,
  });
});

export default app;

Step 2: Fallback Origin Worker & Edge Tenant Resolution (src/index.ts)

Inspect incoming HTTP/HTTPS requests on customer domains at the edge, extract customHostnameMetadata, and serve customized tenant applications.

src/index.ts

// src/index.ts
import { Hono } from "hono";
import customDomainApp from "./custom_domain_service";

type CustomMetadata = {
  tenant_id?: string;
  theme_mode?: string;
  created_at?: string;
};

const app = new Hono();

// Mount custom domain registration API route
app.route("/", customDomainApp);

// Customer custom domain entrypoint (Fallback Origin Worker)
app.get("*", async (c) => {
  const url = new URL(c.req.url);
  const hostname = url.hostname;

  // 1. Retrieve custom metadata injected by Cloudflare Edge during TLS handshake
  const cfProps = c.req.raw.cf as unknown as {
    customHostnameMetadata?: CustomMetadata;
  };

  const metadata = cfProps?.customHostnameMetadata;
  const tenantId = metadata?.tenant_id || "default_public";
  const themeMode = metadata?.theme_mode || "light";

  // 2. Zero-latency tenant lookup! Access tenant ID directly from TLS metadata
  return c.html(`
    <!DOCTYPE html>
    <html lang="en">
    <head>
      <meta charset="UTF-8">
      <title>${hostname} - Multi-Tenant Enterprise SaaS</title>
      <style>
        body {
          background-color: ${themeMode === "dark" ? "#121212" : "#ffffff"};
          color: ${themeMode === "dark" ? "#ffffff" : "#000000"};
          font-family: system-ui, sans-serif;
          padding: 3rem;
        }
        .badge {
          background: #6366f1;
          color: white;
          padding: 0.25rem 0.75rem;
          border-radius: 9999px;
          font-size: 0.875rem;
        }
      </style>
    </head>
    <body>
      <span class="badge">SSL for SaaS Active</span>
      <h1>Welcome to ${hostname}!</h1>
      <p>Connected Tenant ID: <strong>${tenantId}</strong></p>
      <p>Cloudflare edge SSL dynamically issued. Serving with $0 overhead.</p>
    </body>
    </html>
  `);
});

export default app;

Step 3: Instant CNAME Verification & Status Polling Webhook

Set up a polling or webhook endpoint to check if the hostname status has transitioned to active once the customer configures their DNS CNAME record.

// Hostname status lookup endpoint
app.get("/api/v1/domains/status/:hostnameId", async (c) => {
  const hostnameId = c.req.param("hostnameId");
  const zoneId = c.env.CF_ZONE_ID;
  const apiToken = c.env.CF_API_TOKEN;

  const response = await fetch(
    `https://api.cloudflare.com/client/v4/zones/${zoneId}/custom_hostnames/${hostnameId}`,
    {
      headers: {
        "Authorization": `Bearer ${apiToken}`,
      },
    }
  );

  const result = await response.json();
  return c.json(result);
});

Benchmark: AWS NGINX Certbot Cluster vs Cloudflare SSL for SaaS

Here is a maintenance and cost comparison report based on a multi-tenant SaaS serving 1,000 custom customer domains.

Cost & Operational Efficiency Comparison

Conclusion: The Ultimate Architecture for B2B Multi-Tenant SaaS

Stop wrestling with NGINX config files and Certbot renewal errors every time a customer requests a custom domain connection.

The Cloudflare Custom Hostnames (SSL for SaaS) architecture delivers game-changing advantages:

1. $0 SSL Infrastructure Cost: Eliminate hundreds of dollars in monthly NGINX cluster and ALB load balancer charges down to $0.
2. 5-Second TLS Issuance: As soon as a customer sets up their CNAME record, Cloudflare edge nodes generate a trusted SSL certificate within 5 seconds.
3. Zero-Latency Tenant Resolution via customHostnameMetadata: Bypass DB queries entirely by using TLS handshake metadata to route requests in 0.1 ms.
4. Zero SSL Expiration Outages: Eliminate Certbot rate limit errors with 100% automated edge certificate renewals.

Adopt Cloudflare SSL for SaaS and Workers in your B2B SaaS application today to build a fully automated multi-tenant infrastructure.

Related reading: Check out our edge routing guide in Cloudflare Workers Assets & Dynamic Edge Routing.