Annex: Custom domain and external certificate (SaaS)

This page is an annex to Certificate Mechanics. It documents the additional service for managing the customer's own domain and certificate in SaaS mode, available as an add-on to the base service (reference: P3.6 of the licensing model).

1. When this annex applies

This annex applies when an organization in SaaS Full or SaaS Hybrid mode needs to access the Anjana Data platform under its own domain (for example, anjana.miorganizacion.com) instead of Anjana Data's corporate domain (*.anjanadata.net).

In this scenario, the organization has its own registered domain and an SSL/TLS certificate issued by its own CA or by a public CA of its choice. Anjana Data configures that domain and certificate in its infrastructure so that access to the platform takes place from the organization's corporate URL.

This service is part of the additional package P3.6 - Connectivity and Security (SaaS) described in the licensing model and is not included in the base SaaS service.

2. Responsibility model

Activity	Responsible
Domain registration and ownership	Customer
Obtaining, renewing, and managing the certificate lifecycle with its CA	Customer
Delivery of the certificate in standard format via a secure channel before it expires	Customer
Creating the CNAME record in its DNS pointing to the Anjana Data endpoint	Customer
Configuring the custom domain in Anjana Data's infrastructure	Anjana Data
Installing and updating the certificate	Anjana Data

3. Services included in the package

Service	Description
Custom domain	Configuration of the organization's domain as the entry point to the Anjana Data platform.
Certificate import	The organization delivers the certificate in standard format (see section 6) through one of the accepted secure channels (see section 5.3). Anjana Data verifies that the material is complete and installs it.
Assisted renewal	When the organization renews its certificate with its CA, it delivers the new material and Anjana Data updates it within the contractually agreed timeframe.

4. Service exclusions and limits

The scope of this package is strictly limited to the services described in section 3. Any activity, integration, or functionality not explicitly included in that section is excluded from the service, regardless of whether it is mentioned in the following examples. The list below is illustrative and not exhaustive.

Example of excluded request	Reason
ACME automation with the customer's CA (Harica, DigiCert, etc.)	This would require Anjana Data to interact with the organization's CA to renew certificates for domains it does not own, which exceeds the scope of a SaaS provider.
Automatic renewal of certificates on behalf of the customer	The domain is owned by the organization. Anjana Data does not have, and must not assume, authorization to obtain certificates on its behalf from any CA.
CSR generation	The deployment process does not use the CSR under any circumstances. See section 6.3 of the certificate mechanics.
Management of the organization's DNS	The DNS records pointing to Anjana Data's infrastructure are the organization's responsibility with its DNS provider.
Intermediation with the organization's CA	Anjana Data does not maintain a commercial or technical relationship with any external CA.
Wildcard certificates for the corporate root domain	These are not accepted for security reasons. See section 5 of the certificate mechanics.

If the organization requires full autonomy over the lifecycle of its certificates, including ACME automation, there is an alternative documented in the certificate mechanics: deploying its own reverse proxy that routes traffic to the Anjana Data endpoint.

5. Operational process

5.1. Domain onboarding (first time)

The organization informs Anjana Data of the domain it wants to configure.
Anjana Data configures the domain in its infrastructure and provides the destination endpoint.
The organization creates the CNAME record in its DNS pointing to the provided endpoint.
The organization obtains the certificate for that domain from its CA and delivers it in standard format (see section 6) through one of the accepted channels (see section 5.3).
Anjana Data verifies that the material is complete and valid, and installs it.
Anjana Data confirms the installation. The organization verifies access.

5.2. Certificate renewal

The organization is responsible for managing the lifecycle of its certificate and renewing it with its CA before the expiration date. Once renewed:

The organization delivers the new material through one of the accepted channels (see section 5.3).
Anjana Data verifies and installs the new certificate.
Anjana Data confirms the installation. The organization verifies access.

5.3. Accepted channels for certificate delivery

Since the certification material includes private keys, it must be delivered exclusively through a channel that guarantees confidentiality in transit. The following are accepted:

Channel	Description
Attachment in a support ticket	Attach the material directly to the support ticket opened with Anjana Data on the corresponding portal.
One-time-use link	Services such as One-Time Secret allow you to generate an encrypted link that is destroyed after the first access. It does not require Anjana Data to register.
End-to-end encrypted email	Providers such as Gmail (with S/MIME or CSE encryption enabled) or other services that guarantee point-to-point encryption between sender and recipient.
Secrets manager with view-only link	Tools such as Bitwarden Send or other equivalents that generate a temporary access link without requiring Anjana Data to have an account on the service.

Sending certificates or private keys by standard email (without end-to-end encryption), instant messaging systems, or any other channel not included in the list above is not permitted.

6. Certification material requirements

The certification material must be delivered in a standard format that mandatorily includes the following components:

Domain certificate (leaf certificate).
Full certification chain (intermediate certificates up to the root CA).
Private key corresponding to the certificate.
Opening password, if the material is protected.

Accepted delivery formats:

PEM: separate or concatenated .pem or .crt / .key files, including the full chain.
PKCS#12: a .p12 or .pfx file that includes the certificate, chain, and private key, together with the opening password.

Partial deliveries will not be processed. If the material received does not include all required components, Anjana Data will notify the organization and the installation will remain pending until the complete material is received.

Technical requirements of the certificate:

Minimum encryption: RSA 2048 or equivalent ECC.
The issuing CA must be public and recognized. CAs from public bodies (e.g. Harica, FNMT) are accepted as long as the certificate is technically valid.
The certificate must exclusively cover the subdomain configured for Anjana Data, not a wildcard for the corporate root domain.