Automating SSL for Hundreds of Domains: A Step-by-Step Guide

Managing SSL certificates for hundreds of customer domains is a challenge. Manual renewals lead to expired certificates, downtime, and support tickets. You need a centralized automation pipeline that handles ACME rate limits, DNS-01 validation, wildcard certificates, and renewal failures. This guide walks you through building one step by step.

What is ACME and why does it matter for certificate automation?

ACME (Automatic Certificate Management Environment) is the protocol used by Let's Encrypt and other certificate authorities to automate certificate issuance and renewal. It allows you to obtain SSL/TLS certificates without manual intervention. However, ACME has rate limits to prevent abuse. For example, Let's Encrypt allows 50 certificates per registered domain per week and 300 new orders per account per 3 hours. If you manage hundreds of domains, you must design your pipeline to respect these limits.

How does DNS-01 validation work and why use it?

DNS-01 validation proves domain control by adding a TXT record to the domain's DNS. It is the only method that supports wildcard certificates. Unlike HTTP-01, it does not require the domain to be publicly accessible, making it ideal for internal or staging environments. To automate DNS-01, you need API access to your DNS provider or a DNS server you control.

Setting up DNS-01 with popular providers

Most DNS providers offer APIs for record management. For example, Cloudflare, Route 53, and DigitalOcean have APIs that allow you to create and delete TXT records programmatically. You will need to store API credentials securely and handle propagation delays. A common approach is to use a library like acme.sh or certbot with DNS plugins, but for hundreds of domains, you may need a custom solution.

How to handle wildcard certificates in a multi-tenant environment?

Wildcard certificates cover a domain and all its subdomains, e.g., *.example.com. They are useful for customer domains that have many subdomains. However, wildcard certificates require DNS-01 validation. When managing hundreds of customer domains, you can either issue a wildcard per customer domain or use a single wildcard for your own platform and let customers use their own certificates. The former gives customers control but increases the number of certificates you manage. The latter simplifies your infrastructure but may not meet all customer needs.

Building the pipeline: step-by-step

Step 1: Inventory and categorize domains

Start by listing all domains that need certificates. Categorize them by DNS provider, whether they need wildcards, and their renewal schedule. This inventory will help you plan rate limit usage and automate DNS record creation.

Step 2: Choose a certificate management tool

Select a tool that supports ACME, DNS-01, and wildcards. Options include certbot, acme.sh, lego, or a custom solution using an ACME client library. For large-scale automation, consider using a central service that queues and processes certificate requests.

Step 3: Implement DNS-01 validation

Write code that, for each domain, creates the required TXT record via the DNS provider's API, waits for propagation, and then triggers the ACME challenge. After validation, clean up the TXT record. Use asynchronous processing to handle many domains concurrently without hitting DNS API rate limits.

Step 4: Respect ACME rate limits

Implement a rate limiter that tracks certificate issuance per domain and per account. For Let's Encrypt, you can use the Retry-After header from API responses. Distribute requests over time, and use a queue to avoid bursts. If you hit a limit, back off and retry later.

Step 5: Automate renewals and handle failures

Schedule renewals well before expiration, typically 30 days prior. Monitor for failures: DNS propagation issues, API errors, or rate limits. Implement retries with exponential backoff. Log all actions and alert on persistent failures. Use a centralized dashboard to track certificate status across all domains.

How to monitor and troubleshoot renewal failures?

Set up alerts for certificates nearing expiration or renewal failures. Common issues include DNS record conflicts, API credential expiration, and rate limit exhaustion. Use logging and metrics to diagnose problems. For example, if a domain fails validation repeatedly, check if the TXT record was created correctly and if propagation completed.

Integrating with your hosting platform

If you use a hosting automation platform like Teculiar, you can integrate certificate automation directly into your billing and provisioning workflows. This ensures that certificates are issued and renewed as part of the customer lifecycle. For pricing details, see our pricing page.

What to do next

• Audit your current certificate management process and identify gaps.
• Choose an ACME client and DNS provider that support automation.
• Build a prototype for a few domains and test rate limit handling.
• Scale up gradually, monitoring for failures and adjusting your pipeline.

Start by inventorying your domains and selecting the right tools for your scale.