2

We run a large-ish SaaS application hosted on windows 2008R2 / IIS7.5 clusters behind an F5 network appliance cluster.

Today, we offer white labeled branding to customers via custom CNames (your-company.our-domain.com).

We would like to offer the ability for a customer to specify their own domain name for white labeling (www.your-domain.com) for a domain they already own.

By having the customer set up an A or CNAME record on their own DNS server, pointing to an IP we specify, our IIS machines receive the request - but since the entire SaaS app should run through SSL, we are a bit stumped as to how best to proceed.

Currently, we do not offload SSL handling to the F5 appliances, and instead have the IIS machines handle SSL. Our corporate certs are loading into the stores on each windows IIS servers, and configured there.

We are looking for a "best practice" approach to allow a customer to self configure their custom domain with SSL enabled.

Currently, our best idea would be to have the customer upload a PEM containing their key information via their administration panel in our SaaS, and then we would add the cert programmatically to each windows machine and IIS configuration as required. This to me seems like its a bit of a security issue, as doesn't this mean the customer is forced to share their private key with us? (I'm not very strong in asymmetric encryption, so I realize I might be wrong on this part).

Is this a best practice on sites that allow custom domains? Is there a better option? We're also aware our F5 infrastructure allows SSL offloading - if anyone out there is familiar with that solution and knows of something we could take advantage of there.

Thank you everyone for the help.

DigitalPigeon
  • 21
  • 1
  • Why would it be a security issue? The private key is to encrypt data so attackers in the middle can't read it. You're *supposed* to be reading that data - your application can't work otherwise. – ceejayoz Aug 25 '17 at 18:46
  • My thought is that since its not our domain, and not our key, a customer wouldn't want to share it - essentially once we have it, its less secure for them to go do something with it in the future. But, maybe that is just the way it has to be in this kind of implementation. – DigitalPigeon Aug 25 '17 at 20:13
  • They'd be creating a new key, just for this purpose. – ceejayoz Aug 25 '17 at 20:51
  • Cloudflare released the technology called Keyless SSL, https://github.com/cloudflare/keyless But it is not something native in IIS, and you need some efforts to adapt such. – Lex Li Apr 21 '18 at 16:16

0 Answers0