Custom Domains: How VeloCMS Provisions SSL in 60 Seconds

The problem

Every hosting platform that offers custom domains has the same nightmare: SSL certificate provisioning. The traditional flow — generate a CSR, submit to a CA, wait for verification, install the cert, set up auto-renewal — takes hours and requires operational expertise most solo creators don't have.

Cloudflare for SaaS

We use Cloudflare's "for SaaS" product, which handles the entire certificate lifecycle automatically. When a tenant adds their domain, we call the Cloudflare API to provision a hostname. Cloudflare handles DCV (domain control validation) via its own DNS network and provisions a cert within seconds of DNS propagation.

The tenant flow

1. Tenant adds domain in Admin → Settings → Custom Domain. 2. We call POST /zones/{id}/custom_hostnames. 3. We show the tenant two DNS records to add: a CNAME for the domain, and a TXT record for verification. 4. Once DNS propagates, Cloudflare auto-provisions the cert. 5. Traffic routes to our Railway instance automatically.

Cost

$0.10/month per custom hostname after the first 100 free. For our current scale, it costs less than $10/month total. Worth every cent — certificate outages are invisible until they're not, and Cloudflare's uptime is 99.99%.