domain-name-system – SSL and CNAME Records Explained

From RFC 1034 - Domain names - concepts and facilities:

Domain names in RRs which point at another name should always point at the primary name and not the alias. This avoids extra indirections in accessing information. For example, the address to name RR for the above host should be:

52.0.0.10.IN-ADDR.ARPA  IN      PTR     C.ISI.EDU

rather than pointing at USC-ISIC.ARPA. Of course, by the robustness principle, domain software should not fail when presented with CNAME chains or loops; CNAME chains should be followed and CNAME loops signalled as an error.

So yes, it is allowed and properly written software will handle it just OK. CNAME chains aren't however considered good practice and impose an overhead on the infrastructure.

In order to utilize a CNAME pointing to the main IP address of your system, you'd need to be utilizing a subject alternative name certificate covering the client's DNS name.

Alternatively, you could use SNI and have multiple certificates on that IP address, but be warned that a significant percentage of client browsers in use today don't support SNI (specifically IE on Windows XP, about 40% of users) - those users would get certificate errors.

The other option is to have multiple IP addresses that your server's listening on, with different certificates - your clients would then use either a A record pointing to the IP that's assigned to them.

(or if you're using CNAMEs so that you control the target of the A record, then you can have them CNAME to something like client1.example.com, which has the A record for the IP assigned to that client.)