Skip to content
Managed certificates for your domains

Automatic SSL for every domain you run.

Manage publicly-trusted certificates through Cloudflare for SaaS. Add the guided validation, ownership and HTTPS traffic records, then AutoCertify verifies issuance and the live route.

Free live check. No account or card required.

Secure a domain free See how it works
  • Publicly-trusted certs
  • Provider-managed renewal
  • No private keys or CSRs to manage

Bring your hosting setup — confirm its custom-domain routing supports Cloudflare for SaaS

WordPressShopifyWixSquarespaceWebflowClickFunnelsGhostCustom / self-hostedWordPressShopifyWixSquarespaceWebflowClickFunnelsGhostCustom / self-hosted

3

Guided DNS records: validation, ownership and HTTPS traffic

DV

Domain-validated certificates via Cloudflare for SaaS

0

Private keys or CSRs to manage yourself

API

Domain, certificate and verification workflows

What it does

A certificate service that behaves like a concierge.

Generate the validation records, verify domain control and request a publicly-trusted certificate. Cloudflare manages the edge certificate and its renewal; your traffic route brings HTTPS to the site.

Automatic certificate issuance

AutoCertify requests a publicly-trusted TLS certificate after domain control is confirmed. Cloudflare for SaaS manages the certificate and its renewal. Keep validation records in place and route the hostname through the configured Cloudflare service to serve your website over HTTPS.

  • Publicly-trusted certificates issued through Cloudflare for SaaS — no self-signed shortcuts
  • Provider-managed renewal, with certificate validity available in your dashboard
  • Active status requires Cloudflare to confirm both the hostname and its SSL certificate

Custom hostnames & delegated DCV

The delegation CNAME lets Cloudflare validate the certificate, while a separate TXT record ties control of the hostname to your workspace. AutoCertify checks both before issuance and provides the third traffic record that serves the certificate to visitors.

  • A CNAME at _acme-challenge and a workspace-specific TXT at _autocertify-verify
  • Supports subdomains directly; apex hostnames require ALIAS, ANAME, or CNAME flattening at the DNS provider
  • Run a live DNS check to confirm both records before requesting a certificate

A programmable certificate API

Provision domains, fetch validation records, trigger verification and refresh certificate status with an API key. Owner or admin sessions manage keys and webhook destinations. Platforms and agencies can integrate the same domain workflows into their own systems.

  • REST endpoints for domains, certificates, verification links, usage and webhooks
  • Bulk domain provisioning and idempotency keys for certificate issuance
  • Signed issuance, failure and cert.renewed webhook events

Merchant self-serve

Built for the shop owner, not just the sysadmin.

Certificate status & DNS checks

Inspect validity while background reconciliation checks the provider and live route.

Teams, clients & audit

Organize domains by client, with roles and a full audit trail.

Explore every capability

From “Not Secure” to a padlock in four steps.

No CSRs or private keys to manage. Publish both validation records, verify the hostname and confirm your website routes through the configured service.

  1. 1

    Add your domain

    Sign in and add the exact hostname you want to secure. Confirm that your hosting setup can route it through the configured Cloudflare for SaaS service; certificate validation alone does not change website traffic.

  2. 2

    Add the three setup records

    Copy the validation CNAME, workspace ownership TXT and HTTPS traffic CNAME into your DNS provider. Use the exact values from your dashboard, or send your developer the secure setup link.

  3. 3

    Verify and request the certificate

    Run verification after the two validation records propagate. Successful validation starts issuance automatically. AutoCertify then waits for Cloudflare activation and proves that valid HTTPS is served through the traffic route.

  4. 4

    Keep validation healthy

    Cloudflare manages renewal while the hostname remains eligible and correctly configured. Keep all three records published. AutoCertify reconciles provider state and the live route in the background; the dashboard also offers an immediate recheck.

Walk through it

Step 2 · validation DNS records

1. Delegation CNAME Waiting for DNS
Type
CNAME
Name
_acme-challenge.shop.example.com
Value
shop.example.com.a1b2c3d4.dcv.cloudflare.com
TTL
300

Example only · use your dashboard values

2. Workspace ownership TXT Waiting for DNS
Type
TXT
Name
_autocertify-verify.shop.example.com
Value
autocertify-domain-verification=7f8c9a1b2d3e4f5061728394a5b6c7d8
TTL
300

Example only · use your dashboard values

3. HTTPS traffic CNAME Waiting for DNS
Type
CNAME
Name
shop.example.com
Value
fallback.autocertify.net
TTL
300

Example only · use your dashboard values

These illustrate the three setup records. Use the exact values generated for your hostname in the dashboard, then run verification. A secure link lets your DNS admin add all three.

For platforms & agencies

Domain and certificate workflows, over a clean REST API.

Provision domains, fetch validation records, trigger verification and refresh certificate status with an API key. Owner or admin sessions manage keys and signed webhook destinations.

  • Bulk domain provisioning & idempotent certificate issuance
  • Signed events for issuance, failure and renewal
  • Scoped keys, clients, teams and a full audit trail
Read the API reference Quickstart
POST /v1/domains 
curl --fail-with-body --silent --show-error \
  -X POST https://api.autocertify.net/v1/domains \
  -H "Authorization: Bearer $AUTOCERTIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "apex": "shop.example.com" }'

# 201 Created returns the domain with:
# validation.delegation — publish this CNAME
# validation.ownership  — publish this TXT
# validation.status     — DNS validation state
# cert.status           — certificate state
#
# Use the returned DNS values and domain id.
# The quickstart shows the complete verification flow.
How we build it

Four commitments behind every certificate.

Real certificates, or nothing

Certificate active records Cloudflare's confirmation that the hostname and SSL object are active. Site active additionally requires AutoCertify's valid public HTTPS and traffic-route proof.

Set up validation once

A delegation CNAME and workspace ownership TXT support repeat validation; the traffic record serves HTTPS. Keep all three in place while background reconciliation tracks Cloudflare renewal and the live route.

Plain language for humans

SSL is intimidating enough. Every screen is written for the shop owner having a bad morning, not the engineer who already knows what a CSR is.

Programmable underneath

The same platform that hand-holds a first-timer exposes a clean API for the team automating ten thousand domains. Simple on top, serious underneath.

Start free. Automate when you’re ready.

Start with a free domain and explore the dashboard and API. Your dashboard confirms paid-plan availability before you subscribe; contact us for a larger fleet.

Starter

$0no monthly fee

Secure the one site that's showing “Not Secure” with the current Starter allowance.

Start free

No credit card required

For growing teams

Business Pro

$15/ month

For businesses and shops running several sites — with the API and webhooks to automate them.

Choose Business Pro

Secure up to 50 domains

Scale

Custom

For platforms and agencies issuing certificates for thousands of customer domains.

Talk to sales

Per-domain volume pricing

Compare plans in detail

Questions, answered plainly.

What exactly does AutoCertify do?

AutoCertify verifies domain control and requests a publicly-trusted certificate through Cloudflare for SaaS. You add a validation CNAME, an ownership TXT and an HTTPS traffic CNAME or apex equivalent. Cloudflare manages the edge certificate and renewal; AutoCertify confirms the live route before it marks the site active.

Do I need a developer or server access?

You do not need to generate private keys or certificate signing requests. You need access to DNS to add the three records and a hosting setup compatible with the configured Cloudflare traffic route. A verification link lets your developer add them without sharing your account.

How is this different from Let's Encrypt or my host's SSL?

Let's Encrypt is a certificate authority — one source of certificates. AutoCertify is the automation that gets a valid, publicly-trusted certificate onto your domain and keeps it renewed, issued for you through Cloudflare for SaaS. If your host already handles SSL, great — you may not need us. AutoCertify is for the domains that fall through the cracks: custom domains on no-SSL builders, funnels, multi-domain fleets and anything your platform won't secure for you.

Why do I need validation and traffic DNS records?

The CNAME at _acme-challenge delegates certificate validation to Cloudflare. A separate TXT record at _autocertify-verify proves that your workspace controls the hostname. Both are required before issuance; the third CNAME (or apex equivalent) routes visitors through the managed HTTPS service. Keep all three published while AutoCertify manages the hostname.

How long does it take to go secure?

Timing depends on DNS propagation and the certificate provider. Publish all three setup records and run verification. AutoCertify refreshes provider state and checks the live route automatically; the dashboard keeps validation, certificate and routing status separate so you can identify the next step.

Can I automate this for many domains?

Yes. The REST API supports bulk provisioning, validation and traffic records, verification, certificate refresh and signed certificate lifecycle events. API access currently does not require a Business Pro or Scale subscription. Owner or admin sessions manage API keys and webhook destinations; integrations use the appropriate key scopes for domain and certificate operations.

Is my first domain really free?

Starter lets you begin with a free domain and view its certificate status in the dashboard. API access and webhook management are currently available without a paid-plan gate. Your dashboard and checkout show the paid plan available to your workspace before any subscription charge.

Still deciding? Talk to us or log in to your dashboard.