We are currently running a SaaS over HTTPS(abc.net) and one of our clients(xyz.com) wants to do some custom branding. The client xyz.com will have their own subdomain xyz.abc.net which looks like its part of xyz.com when viewed from a web browser.
The client will add CNAME records to their DNS so that the HTTP(S) requests made towards xyz.com will be routed to xyz.abc.net.
The above should work in theory as both xyz.com and *.abc.net have verified Certificates.
But, what will be the certificate that will be visible in the address bar for an average user when they access xyz.com? If the user sees the Certificate of *.abc.net instead of xyz.com, is there any way to change it?
Since there already exists a certificate for *.abc.net, the customer cannot get a new certificate for their subdomain.
I already found this, but it seems a bit different from the above question. also the client does not want to proxy(which requires them to run servers).