Apache - Virtual Hosting Mass Client Configurable SSL, Reverse Proxy

Solution 1:

I would put Hitch TLS proxy in front of apache - https://hitch-tls.org/.

From the feature list:

• Safe for large installations: performant up to 15 000 listening sockets and 500 000 certificates.
• Support for seamless run-time configuration reloads of certificates and listen endpoints.

Unless it is very important for your users to create CSR's and choose CA's themselves, consider enabling hitch with Let's Encrypt and Acmetool. With a little scripting for adding and removing domains respectively, you'll get free certificates for all domains with automatic issuing and automatic renewal. Set and forget = Win:Win.

See: https://info.varnish-software.com/blog/five-steps-to-secure-varnish-with-hitch-and-lets-encrypt