Skip to content
Managed certificates for your domains

Automatic SSL for every domain you run.

Manage publicly-trusted certificates through Cloudflare for SaaS. Add a delegation CNAME and ownership TXT record, verify your hostname, and manage issuance from the dashboard or API.

Secure a domain free See how it works
  • Publicly-trusted certs
  • Provider-managed renewal
  • No private keys or CSRs to manage

Bring your hosting setup — confirm its custom-domain routing supports Cloudflare for SaaS

WordPressShopifyWixSquarespaceWebflowClickFunnelsGhostCustom / self-hostedWordPressShopifyWixSquarespaceWebflowClickFunnelsGhostCustom / self-hosted

2

Validation records: a CNAME and ownership TXT

DV

Domain-validated certificates via Cloudflare for SaaS

0

Private keys or CSRs to manage yourself

API

Domain, certificate and verification workflows

What it does

A certificate service that behaves like a concierge.

Generate the validation records, verify domain control and request a publicly-trusted certificate. Cloudflare manages the edge certificate and its renewal; your traffic route brings HTTPS to the site.

Automatic certificate issuance

AutoCertify requests a publicly-trusted TLS certificate after domain control is confirmed. Cloudflare for SaaS manages the certificate and its renewal. Keep validation records in place and route the hostname through the configured Cloudflare service to serve your website over HTTPS.

  • Publicly-trusted certificates issued through Cloudflare for SaaS — no self-signed shortcuts
  • Provider-managed renewal, with certificate validity available in your dashboard
  • Active status requires Cloudflare to confirm both the hostname and its SSL certificate

Custom hostnames & delegated DCV

The delegation CNAME lets Cloudflare validate the certificate, while a separate TXT record ties control of the hostname to your workspace. AutoCertify generates both records and checks them before issuance. Keep them published so future validation can use the same setup.

  • A CNAME at _acme-challenge and a workspace-specific TXT at _autocertify-verify
  • Works on apex domains and individual subdomains — add each hostname once, at any registrar
  • Run a live DNS check to confirm both records before requesting a certificate

A programmable certificate API

Provision domains, fetch validation records, trigger verification and refresh certificate status with an API key. Owner or admin sessions manage keys and webhook destinations. Platforms and agencies can integrate the same domain workflows into their own systems.

  • REST endpoints for domains, certificates, verification links, usage and webhooks
  • Bulk domain provisioning and idempotency keys for certificate issuance
  • Signed cert.issued, cert.issue_pending and cert.issue_failed webhook events

Merchant self-serve

Built for the shop owner, not just the sysadmin.

Certificate status & DNS checks

Inspect validity, refresh provider status and recheck DNS.

Teams, clients & audit

Organize domains by client, with roles and a full audit trail.

Explore every capability

From “Not Secure” to a padlock in four steps.

No CSRs or private keys to manage. Publish both validation records, verify the hostname and confirm your website routes through the configured service.

  1. 1

    Add your domain

    Sign in and add the exact hostname you want to secure. Confirm that your hosting setup can route it through the configured Cloudflare for SaaS service; certificate validation alone does not change website traffic.

  2. 2

    Add two validation records

    Copy the delegation CNAME and workspace ownership TXT record into your DNS provider. Use the exact values from your dashboard, or send your developer a verification link to add both.

  3. 3

    Verify and request the certificate

    Run verification after both records propagate. Successful validation starts issuance automatically. Refresh status until Cloudflare reports both the hostname and certificate active, then confirm HTTPS through your configured traffic route.

  4. 4

    Keep validation healthy

    Cloudflare manages renewal while the hostname remains eligible and correctly configured. Keep both DNS records published. Recheck DNS and refresh certificate status from the dashboard or your integration to catch configuration changes.

Walk through it

Step 2 · validation DNS records

1. Delegation CNAME Waiting for DNS
Type
CNAME
Name
_acme-challenge.shop.example.com
Value
shop.example.com.a1b2c3d4.dcv.cloudflare.com
TTL
300

Example only · use your dashboard values

2. Workspace ownership TXT Waiting for DNS
Type
TXT
Name
_autocertify-verify.shop.example.com
Value
autocertify-domain-verification=7f8c9a1b2d3e4f5061728394a5b6c7d8
TTL
300

Example only · use your dashboard values

These illustrate the two record types. Use the exact values generated for your hostname in the dashboard, then run verification. A verification link lets your DNS admin add both.

For platforms & agencies

Domain and certificate workflows, over a clean REST API.

Provision domains, fetch validation records, trigger verification and refresh certificate status with an API key. Owner or admin sessions manage keys and signed webhook destinations.

  • Bulk domain provisioning & idempotent certificate issuance
  • Signed events for issued, pending and failed issuance
  • Scoped keys, clients, teams and a full audit trail
Read the API reference Quickstart
POST /v1/domains 
curl --fail-with-body --silent --show-error \
  -X POST https://api.autocertify.net/v1/domains \
  -H "Authorization: Bearer $AUTOCERTIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "apex": "shop.example.com" }'

# 201 Created returns the domain with:
# validation.delegation — publish this CNAME
# validation.ownership  — publish this TXT
# validation.status     — DNS validation state
# cert.status           — certificate state
#
# Use the returned DNS values and domain id.
# The quickstart shows the complete verification flow.
How we build it

Four commitments behind every certificate.

Real certificates, or nothing

Active status records Cloudflare's confirmation that the hostname and its certificate are active. Refresh to retrieve current provider state, and confirm the website's HTTPS connection through its configured traffic route.

Set up validation once

A delegation CNAME and workspace ownership TXT record support repeat validation. Keep them in place while Cloudflare manages renewal, and recheck if your DNS or hosting configuration changes.

Plain language for humans

SSL is intimidating enough. Every screen is written for the shop owner having a bad morning, not the engineer who already knows what a CSR is.

Programmable underneath

The same platform that hand-holds a first-timer exposes a clean API for the team automating ten thousand domains. Simple on top, serious underneath.

Start free. Automate when you’re ready.

Start with a free domain and explore the dashboard and API. Your dashboard confirms paid-plan availability before you subscribe; contact us for a larger fleet.

Starter

$0forever

Secure the one site that's showing “Not Secure.” Free, for as long as you need it.

Start free

No credit card required

For growing teams

Business Pro

$15/ month

For businesses and shops running several sites — with the API and webhooks to automate them.

Start free

Secure up to 50 domains

Scale

Custom

For platforms and agencies issuing certificates for thousands of customer domains.

Talk to sales

Per-domain volume pricing

Compare plans in detail

Questions, answered plainly.

What exactly does AutoCertify do?

AutoCertify verifies domain control and requests a publicly-trusted certificate through Cloudflare for SaaS. You add a delegation CNAME and workspace ownership TXT record. Cloudflare manages the edge certificate and renewal; your hostname must also route through the configured service before it can serve your website over HTTPS.

Do I need a developer or server access?

You do not need to generate private keys or certificate signing requests. You need access to DNS to add the CNAME and TXT records, and a hosting setup compatible with the configured Cloudflare traffic route. A verification link lets your developer add the records without sharing your account.

How is this different from Let's Encrypt or my host's SSL?

Let's Encrypt is a certificate authority — one source of certificates. AutoCertify is the automation that gets a valid, publicly-trusted certificate onto your domain and keeps it renewed, issued for you through Cloudflare for SaaS. If your host already handles SSL, great — you may not need us. AutoCertify is for the domains that fall through the cracks: custom domains on no-SSL builders, funnels, multi-domain fleets and anything your platform won't secure for you.

Why do I need a CNAME and a TXT record?

The CNAME at _acme-challenge delegates certificate validation to Cloudflare. A separate TXT record at _autocertify-verify proves that your workspace controls the hostname. Both are required before AutoCertify starts issuance. Keep both records published so later checks can reuse them.

How long does it take to go secure?

Timing depends on DNS propagation and the certificate provider. Publish both records, run verification, then refresh the provider state. An active certificate also needs the correct website traffic route to serve HTTPS. The dashboard keeps validation and certificate status separate so you can identify the next step.

Can I automate this for many domains?

Yes. The REST API supports bulk provisioning, validation records, verification, certificate refresh and signed issuance events. API access currently does not require a Business Pro or Scale subscription. Owner or admin sessions manage API keys and webhook destinations; integrations use the appropriate key scopes for domain and certificate operations.

Is my first domain really free?

Starter lets you begin with a free domain and view its certificate status in the dashboard. API access and webhook management are currently available without a paid-plan gate. Your dashboard and checkout show the paid plan available to your workspace before any subscription charge.

Still deciding? Talk to us or log in to your dashboard.