A Subdomain and SSL Certificate for Every SaaS Tenant
The basic architecture for routing tenant subdomains with wildcard DNS and securing them with one certificate.
Omar Alalwi Article
A SaaS platform can organize tenant URLs as paths under its main domain, such as example.com/tenant-1, or as separate subdomains such as tenant-1.example.com. Paths simplify DNS and TLS, while subdomains give each tenant a clearer identity at the cost of additional setup.
In Laravel, domain routing can match {tenant}.{mainDomain}, followed by middleware that validates the tenant, loads its data, and isolates its queries. Names such as www, api, and admin must be reserved so tenants cannot claim them.
At the DNS layer, a wildcard * record points to the server. A certificate covering example.com and *.example.com is then issued and installed with its private key on Nginx, Apache, or the hosting platform. Once the origin certificate is working correctly between Cloudflare and the server, Full (Strict) can provide validated encryption in both directions.
This design avoids issuing a new certificate for every subdomain. Tenant data isolation, host validation, and authorization still remain separate and essential parts of a secure multi-tenant architecture.
Share your perspective
I’d be glad to hear your perspective. Leave a comment on the original article on social media.