[bks]

We had a similar issue but not identical which led us to deploying all customers on a subdomain or their own domain. Rather than theirBusinessName.OurDomain.com people switched to shop.theirBusinessName.com and we used DNS cnames to point back to our servers.

We issued LetsEncrypt certificates automatically using Caddy and it works remarkably well for us. It also led us to become a paid LetsEncrypt sponsor and we have been for the past 4 years.

[bombcar]

This is the way to do it. And if you're charging anything reasonable for SaaS service consider just registering a domain for your customers if they can't figure out how to delegate a subdomain CNAME.