A monitoring service needed to offer public status pages on customer domains for white-label use by web studios. Clients add a CNAME record pointing their subdomain to the service endpoint, after which the platform must serve the page over HTTPS with a valid certificate.
The team rejected ACME on-demand solutions such as Caddy or OpenResty auto-SSL for three reasons. Private keys would reside inside the application process or require an additional stateful component. Any attacker could point arbitrary domains at the IP and trigger Let's Encrypt issuance, exhausting the 300-order rate limit per account. Issuing certificates during the TLS handshake also imposes latency on the first visitor and risks connection drops if the CA is unreachable.
Instead, domains are stored in the database when users enter them in settings. A four-stage pipeline handles the rest: input normalization and validation in Go, periodic DNS verification by a background goroutine, certificate issuance and nginx configuration by a privileged helper script, and request routing inside the application.
Validation rejects empty strings only when removing a domain, blocks the service's own domains to prevent takeover of internal pages, and requires Punycode for internationalized names so users see exactly what they must configure at their registrar. After saving, the domain enters pending status.
The DNS verifier runs every five minutes. It first checks for a matching CNAME and falls back to comparing A records for apex domains where CNAME is prohibited by RFC. Temporary DNS failures do not downgrade an already verified or active domain; only a warning is recorded. This hysteresis avoids random outages for customers whose pages are already live.
A systemd-timer script running as root queries the application over loopback, runs certbot with the webroot challenge, writes per-domain nginx server blocks from a template, and notifies the application when a domain becomes active. Certificates for removed domains are left untouched and simply expire naturally. The script always validates input with a regex and runs nginx -t before reloading.
Inside the Go application a HostRouter middleware maps verified custom hosts to the corresponding status page while returning 404 for all other paths, preventing exposure of dashboards or APIs. Internal endpoints used by the helper are protected by checking for the absence of X-Forwarded-For and X-Real-IP headers in addition to loopback address validation.
The scheme works well for hundreds of domains on a single server. It avoids rate-limit exhaustion because issuance occurs only after confirmed DNS ownership, keeps certificate handling outside the application, and ensures that failure of any single component does not affect already-active customer pages.
