Using my own CNAME value

Questions / Help
1

I am planning to use fly in my saas to allow my customers to add their custom domain.

I would like to have the cname value be my own domain.

I tried to set up a cname to point my domain to my-app.fly.dev, and then a certificate from some subdomain pointing to my domain.

The problem I am having is that this causes the certificate validation for the subdomain to not work.

Any ideas on how I could solve this?

2

This should work.

Can you give us an example hostname that didn’t work? I can try and find out why.

3

Yeah sure.

I have pointed domains.dev.picflow.com to picflow-custom-domains.fly.dev

And then I have pointed custom-domain.nathanfelix.com to domains.dev.picflow.com

4

Any update on this? I would really like to use fly but this is a blocker for us. Thanks

5

Sorry it took so long, I got distracted… :confused:

Our hostname check won’t allow this one through because if we go up the chain and ask the authoritative servers, for your hostname, for CNAME, A and AAAA records, we get nothing. It seems to resolve fine from Google DNS though.

Here’s what seems to be happening:

  • We lookup custom-domain.nathanfelix.com and find that it has a CNAME to domains.dev.picflow.com
  • We lookup domains.dev.picflow.com via its SOA (Start of Authority).
    • It has none because it’s not a root domain.
    • So we check if it has a public suffix. It does: picflow.com
    • We get the SOA of picflow.com and we get: ns-1513.awsdns-61.org
    • We resolve ns-1513.awsdns-61.org to an IP.
    • We also get the NS of the root domain:
      • ns-1513.awsdns-61.org
      • ns-1734.awsdns-24.co.uk
      • ns-677.awsdns-20.net
      • ns-99.awsdns-12.com
    • We resolve all of these to IPs and create a dns client that will use the SOA and the NS we got. Both IPv4 and IPv6 addresses
    • We try to resolve either another CNAME or an A or AAAA record for domains.dev.picflow.com using the DNS client with the servers we just found
      • We get nothing for it.

This is all to “emulate” the process Let’s Encrypt goes through when it attempts to verify challenges. This works for almost all hostnames.

I’m not entirely sure why that’s not true for yours. It’s as if AWS is not aware of the records you’ve setup. I’m assuming you’re with AWS Route53 here.

6

Good news! We figured out what’s up with this one.

dev.picflow.com has a different SOA record than picflow.com (likely because the zone is managed separately). We weren’t detecting the right authority for subdomains, so your DNS looked wrong to us. That’s fixed, now, and you should see certificates generate properly.

1 Like
7

Thanks for the help guys! I can confirm that it works now

8

Hi nathan-felix,

Can you help me out and post how you accomplished this? I am also looking to support custom domains for my customers but at the moment I am thinking only way I can do this is to create certs for each of their domains which seems overkill.

9

Hi Alphapage, we use fly.io to create the certs for us. The only issue that we had was a bug on the fly.io side, which they solved and it has been working great since.