Cloudflare SSL for SaaS Providers

Manually Upload Certificates

To initiate the processes of adding SSL to custom CNAME’d vanity domains, a process is setup by which customers buy and send purchased certificates to the SaaS provider for manual upload.

Manually Manage Certificate Lifecycles

Upon uploading customer certificates, manual management is required in order to handle the lifecycle of said certificates. This includes private key issuance/protection through domain validation, issuance, renewal, and reissuance.

Build API Integration (e.g. using Let’s Encrypt)

As the total number of websites and customers using a SaaS provider’s services starts to scale, a decision will be required to be made: Automate the SSL lifecycle process for custom domains, which takes a higher level of engineering effort, or continue to build-out a manual lifecycle management, which requires less engineering effort but places a burden on internal teams and end customers.

Securely handle encryption keys

Private keys are required to have secure storage, encryption at rest, and never written to disk in plaintext. Encrypting keys is easy, but decrypting them on-the-fly is difficult, as it either requires manual effort or considerable engineering work. Private key management best practices have been published here on OWASP.org. Cloudflare is expert at generating and protecting private keys for millions of domains through our Universal SSL, Dedicated Certificates, and SSL for SaaS products.

Global certificate distribution network

Systematically distributing certificates around the world, making them available as close to your customers’ visitors as possible, is required to mitigate performance losses. The further an end customer’s visitor’s request must travel, the slower their page load times will become. With TLS 1.2, an initial TLS handshake requires 2 round trips; if this handshake can only end up at a few locations, performance will suffer.

Ongoing maintenance and continued support efforts (Automated Path)

For SaaS companies who’ve chosen an automated approach to building an in-house SSL solution, the majority of maintenance will consist of keeping code bases updated and compatible with certificate authority integrations and standards.

Build and train customer contact team

A new or existing team within the SaaS provider company will be required to manually manage the certificate lifecycles for end customers. Customer contact teams will be required to reach out to customers, offering updates on certificate expiration and requesting the renewal of new certificates.

Manual renewals with required customer effort

Customers are required to take part in the certificate renewal process by renewing and re-sending these certificates to the team in charge of managing the upload process. Additionally, they must conduct this renewal process prior to the existing certificate expiration. If expiration of existing certificates happens, the customer’s Internet assets will go likely go offline unless preventative steps are taken.

Global certificate distribution network

Systematically distributing certificates around the world, making them available as close to your customers’ visitors as possible, is required to mitigate performance losses. The further an end customer’s visitor’s request must travel, the slower their page load times will become. With TLS 1.2, an initial TLS handshake requires 2 round trips; if this handshake can only end up at a few locations, performance will suffer.

Ongoing maintenance and continued support efforts (Manual Path)

For SaaS companies who’ve chosen the manual approach to building an in-house SSL solution, a majority of maintenance will consist of continued manual efforts by SaaS providers to securely protect private keys, manage certificate lifecycles, remind customers to renew, and re-upload new certificates; SaaS provider end customers will be burdened by having to take part in the certificate lifecycle process by renewing and re-sending certificates on a regular cadence.

Easy Cloudflare API / UI Integration

Cloudflare’s SSL for SaaS solution requires minimal engineering efforts, and removes the burden of managing the SSL lifecycle for both SaaS providers and their end customers.