mgarden

Cloudflare for SaaS

3 min read

cloudflare saas ssl dns claude-curated

Cloudflare for SaaS (formerly SSL for SaaS) lets a SaaS provider serve traffic on hostnames their customers own. Customers point their domain (e.g. app.customer.example) at the SaaS platform, Cloudflare provisions and manages TLS certificates for those hostnames, and proxies traffic to the SaaS origin.

Custom Hostnames vs Custom Domains

ConceptOwnerLives OnPurpose
Custom DomainSaaS providerProvider’s Cloudflare zoneThe provider’s own zones (e.g. saas.example)
Custom HostnameCustomerAttached to provider’s SaaS-enabled zoneA third-party hostname (e.g. learn.customer.example) routed to the provider

A custom hostname is a record on the SaaS provider’s zone that authorizes Cloudflare to serve traffic for the customer’s hostname. The customer never gets access to the provider’s Cloudflare account; they only point DNS.

The Fallback Origin

Custom Hostnames require a Fallback Origin to be configured and active before any custom hostname can be created.

  • The fallback origin is a hostname (in the SaaS-enabled zone) that points to the SaaS origin (e.g. a load balancer).
  • All custom hostname traffic resolves through this fallback unless overridden by a per-hostname origin.
  • It must be active on the Cloudflare API before custom hostname provisioning works — provisioning silently stalls otherwise.
# Check fallback origin status
curl -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE/custom_hostnames/fallback_origin" \
     -H "Authorization: Bearer $TOKEN"

SSL Validation Flow

Two distinct TXT records are involved. They serve different purposes and are often confused.

1. Certificate Validation TXT (_acme-challenge)

  • Used by the CA (Let’s Encrypt or Google Trust Services) to prove control of the hostname under the ACME protocol (RFC 8555).
  • Record name: _acme-challenge.<hostname>
  • Value rotates on every renewal.
  • Required every renewal cycle unless the customer uses a CNAME delegation: _acme-challenge.app.customer.example -> _acme-challenge.app.customer.example.<saas-zone>

2. Hostname Pre-Validation TXT

  • Used by Cloudflare to verify the customer has authorized the SaaS provider to serve traffic for their hostname before they cut DNS over.
  • Record name and value supplied by the Cloudflare API on hostname creation.
  • One-shot: removed once Cloudflare confirms ownership.
  • Optional but recommended: lets the SaaS platform pre-issue the cert so cutover is instant and zero-downtime.

Customer DNS Steps

  1. Add the hostname pre-validation TXT (one-shot) — proves ownership.
  2. Add _acme-challenge TXT or CNAME delegation — enables ongoing cert renewal.
  3. Add a CNAME from the custom hostname to the SaaS provider’s fallback origin (or a per-tenant target).
  4. Wait for status active in the SaaS dashboard.
app.customer.example.            CNAME  saas-tenants.saas.example.
_acme-challenge.app.customer.example.  CNAME  _acme-challenge.app.customer.example.saas.example.

Apex Domain Limitation

A CNAME cannot be set at the apex of a domain in standard DNS (RFC 1912). See Apex Domain Limitations. Customers wanting customer.example (no subdomain) routed via Cloudflare for SaaS need either:

  • An ALIAS / ANAME flattening at their DNS provider (provider-specific), or
  • Cloudflare BYOIP / Apex Proxying — a paid Enterprise add-on that gives the SaaS dedicated IPs to point A/AAAA records at.

Most SaaS providers steer customers to a subdomain (app., learn., portal.) to avoid this entirely. See Cloudflare Plans for plan availability.

Certificate Authorities

Cloudflare for SaaS supports two ACME CAs (see TLS Certificate Authorities):

CANotes
Let’s EncryptDefault, free, 90-day certs. Subject to LE rate limits (50 certs/registered-domain/week).
Google Trust ServicesFree, 90-day certs. Useful as a fallback if LE rate-limits hit, or for customers whose security policy allows GTS but not LE.

Cloudflare can be configured to attempt both, falling back automatically. Each CA does its own ACME challenge against the same _acme-challenge record — one record satisfies both.

See also

References

Graph View

Backlinks