The host name and certificate verification (and in fact, checking that SSL is used at all) are solely the responsibility of the client.
The host name verification will be done by the client, as specified in RFC 2818, based on the host name they request in their URL. Whether the host name DNS resolution is based on a CNAME entry or anything else is irrelevant.
If users are typing https://user1.theirsite.com/
in their browser, the certificate on the target site should be valid for user1.theirsite.com
.
If they have their own server for user1.theirsite.com
, different to user1.mysite.com
, a DNS CNAME entry wouldn't make sense. Assuming the two hosts are effectively distinct, they could have their own valid certificate for user1.theirsite.com
and make a redirection to https://user1.theirsite.com/
. The redirection would also be visible in the address bar.
If you really wanted to have a CNAME from user1.theirsite.com
to user1.mysite.com
, they might be able to give you their certificate and private key so that you host it on your site too, using Server Name Indication (assuming same port, and of course same IP address since you're using a CNAME). This would work for clients that support SNI. There would however be a certain risk to them in giving you their private keys (which isn't generally recommended).