Cloudflare for SaaS is designed for this use case. You would just go to Cloudflare Dashboard > You Domain (example.com) -> SSL -> Custom Hostnames. Add a fallback hostname to which you client will link to, e.g. ssl.example.com.

Then client then would need to add his or her custom hostname in your app, then link and verify his custom domain by adding a CNAME (pointing to ssl.example.com) and TXT record via his own DNS provider. The verification and issuing a new SSL would take a few minutes, completely handled by Cloudflare and from there on, your clients may access your service via custom hostname (e.g. client.com, sub.client.com, client.com/blog etc.)

If you need to manipulate the HTTP response as it goes through the customer's hostname, it's also possible to route these request through a CLoudflare Worker script (linked to */* — all hostnames/URLs).

Here is an example, of how to create a custom hostname programmatically:

import * as Cloudlfare from "cloudflare-client";

// Initialize custom hostnames client for Cloudlfare
const customHostnames = Cloudflare.customHostnames({
  zoneId: process.env.CLOUDFLARE_ZONE_ID,
  accessToken: process.env.CLOUDFLARE_API_TOKEN,
});

// Add the client's custom hostname record to Cloudflare
const record = await customHostnames.create(
  hostname: "www.client.com",
  ssl: {
    method: "txt",
    type: "dv",
    settings: {
      min_tls_version: "1.0",
    },
  }
);

// Fetch the status of the custom hostname
const status = await customHostnames.get(record.id);
// => { id: "xxx", status: "pending", ... } including TXT records

Pricing

CF for SaaS is free for 100 hostnames and $0.10/hostname/mo after (source).

Path-based URL forwarding

If you need to forward HTTP traffic to different endpoints, e.g. www.client.com/* (customer domain) to web.example.com (SaaS endpoint); www.client.com/blog/* to blog.example.com, etc.

You can achieve that by creating a Cloudfalre Worker script with a route handling */* requests (all customer hostnames, and all URL paths), that would look similar to this:

export default {
  fetch(req, env, ctx) {
    const url = new URL(req.url);
    const { pathname, search } = url;

    if (url.pathname === "/blog" || url.pathname.startsWith("/blog/")) {
      return fetch(`https://blog.example.com${pathname}${search}`, req);
    }

    return fetch(`https://web.example.com${pathname}${search}`;
  }
}

References

• https://developers.cloudflare.com/cloudflare-for-saas/
• https://github.com/kriasoft/cloudflare-client
• https://github.com/kriasoft/cloudflare-starter-kit

The simplest approach to this, which I’ve implemented at scale (10,000+ clients), is to:

DNS

1. Have your clients create a CNAME record to either a specific client.example.com or general clients.example.com. This applies to both root (set the ALIAS record instead) and subdomains—an IP address is not required, nor recommended as it does not scale.
2. Create a database entry that registers/links that explicitly links their domain/subdomain to their account.
3. Have logic in the backend controller will that associates the hostname in the request to a specific client (security measure) to serve relevant content.

The above fulfills the first two use cases—it allows the client to link a root domain or subdomain to your service.

To achieve the third use case, you could allow the client to specify an arbitrary root path for your service to run within. If the client chooses this, you also need to handle redirects to other services that they have on their domain. This is a lot of responsibility for your app, however.

You could just leverage their registrar, most registrars have the ability to do path redirects—this is the simplest approach that requires the least amount of responsibility/maintenance on your end.

I also recommend having an option for redirecting all entry points (ie: root domain, subdomain, root domain+path, subdomain+path) to a primary entry point (ie: root domain + path), for SEO purposes.

Note: You may also use a service, such as wwwizer, that redirects to the www specified if the ALIAS option on the root domain of your client isn't available.

SSL

I recommend using Let's Encrypt's ACMEv2 API to enable SSL for any domain that is setup on your service. There are libraries available that you should be able.

What is worth mentioning is the challenge — which can occur via DNS or HTTP. When the library you decide on makes a request for a new certificate Let's Encrypt will respond by making a request to ensure that you control the domain (by checking DNS record for a predetermined unique hash) or that you control the server it points to (by checking HTTP path for a predetermined unique hash). What that means is that you need to ensure that your client either includes a hash in their DNS that you specify or you expose a route that adheres to the ACME v2 challenge response protocol (handled by the library you choose).

Here is an example library that you could use if the service you are building is based on python, which supports all features mentioned above and also includes a cli: https://github.com/komuw/sewer .

References

https://help.ns1.com/hc/en-us/articles/360017511293-What-is-the-difference-between-CNAME-and-ALIAS-records-

https://letsencrypt.org/docs/client-options/

https://datatracker.ietf.org/doc/html/rfc8555

http://wwwizer.com

I think what you are asking is how to have the client have their own domain, which they own, have a subdomain which points to your website, with a matching certificate somehow. But just from a security standpoint there is no safe way to do this IMO. Here are the ways off the top of my head you can do this:

You Manage DNS of Subdomain

Your customer could create a NS record to a public Route53 distribution which you own. Then that subdomain would effectively be yours, and you can create DNS records in their subdomain, and certificates in ACM which you can use in a Cloudfront Distribution. You can have multiple FQDN in the one certificate so you won't have to have multiple distributions. You will need to add the domains to the aliases in your distribution as well.

Client Manages own DNS but you tell them what to do

I'm not sure this works as I haven't tried it, but in the DNS validation of a ACM certificate you can see the records you need to create, you would tell the client the CNAME record which they need to create for AWS to issue a certificate for the given domain i.e. sub.client.com, and they would also need to create CNAMEs to point to your website. This way the client still manages their own DNS.

Import Certificate

You could get your client to create a cert for you can then you could import it. They would also need to create the CNAME records to point to your website. And again they would need to create a CNAME to point to your site. Probably least secure, and certs will require manual rotation.

Cloudfront

Your client can use your website as an origin in their own Cloudfront Distribution, bit hacky but would work. I don't think this scales with growing customers.

Summary

IMO I don't like any of those solutions, they are all messy, most likely non-compliant with security standards, and hard to automate if at all. Not to say there aren't situations where you might do this. I would suggest you create subdomains for your own domain, or otherwise consider yourself a hosting company and then you would own/manage your client's domains on their behalf then this easier. But IMO it does not make sense to own a domain, and then give out control to it, or transfer certificates. You'll run into trouble with customers who need to hold certain certifications, or need you to hold those, such as SOC2 for example.