Problem
Airtable custom domains currently rely on certificates managed and provisioned by Airtable. This works well for most customers, but organizations with strict security, compliance, or internal PKI requirements may need to use a certificate issued by their own approved Certificate Authority.
For these organizations, being able to control the certificate associated with an Airtable custom domain is an important requirement.
Proposed solution
Allow Enterprise customers to configure a customer-managed SSL/TLS certificate for their Airtable custom domain.
The configuration could allow administrators to:
- Upload a certificate and corresponding private key, or provide a supported certificate-management integration.
- Configure the certificate for a specific custom domain.
- Replace/rotate certificates without changing the domain.
- View certificate status and expiration date.
- Receive notifications before certificate expiration.
- Support standard certificate chains and commonly used key types.
- Securely store private keys and prevent them from being exposed after upload.
Use case
For example, an organization may have a corporate PKI policy requiring all externally accessible services to use certificates issued by its approved CA.
The organization would like to use:
https://airtable.example.com
with a certificate issued and managed by its corporate PKI, rather than having Airtable automatically provision and manage the certificate.
Security considerations
The implementation should ensure that:
- Private keys are encrypted at rest and never exposed through the UI or API.
- Certificate/domain ownership is validated before activation.
- Invalid or expired certificates cannot be activated.
- Certificate rotation can happen without unnecessary downtime.
- Appropriate audit logs are generated for certificate changes.
Why this matters
Customer-managed certificates would make Airtable custom domains compatible with environments that enforce centralized certificate management, private PKI policies, or strict compliance requirements.
This would be particularly useful for Enterprise customers with existing certificate lifecycle management processes.
Problem
Airtable custom domains currently rely on certificates managed and provisioned by Airtable. This works well for most customers, but organizations with strict security, compliance, or internal PKI requirements may need to use a certificate issued by their own approved Certificate Authority.
For these organizations, being able to control the certificate associated with an Airtable custom domain is an important requirement.
Proposed solution
Allow Enterprise customers to configure a customer-managed SSL/TLS certificate for their Airtable custom domain.
The configuration could allow administrators to:
Use case
For example, an organization may have a corporate PKI policy requiring all externally accessible services to use certificates issued by its approved CA.
The organization would like to use:
https://airtable.example.comwith a certificate issued and managed by its corporate PKI, rather than having Airtable automatically provision and manage the certificate.
Security considerations
The implementation should ensure that:
Why this matters
Customer-managed certificates would make Airtable custom domains compatible with environments that enforce centralized certificate management, private PKI policies, or strict compliance requirements.
This would be particularly useful for Enterprise customers with existing certificate lifecycle management processes.