5 ms·

How to use Let's Encypt with Google Cloud Platform

55 points by tomasreimers 9y ago

danielecook 9y ago
I'm looking for a way to automate the process. Has anyone got any ideas?
- hatstand 9y ago
  Work in progress but: https://github.com/hatstand/gacertsbot/blob/master/appengine/README.md https://github.com/hatstand/gacertsbot/blob/master/appengine... Currently relies on a fix to the appengine go SDK though: https://github.com/golang/appengine/pull/82 https://github.com/golang/appengine/pull/82
  - bg0 9y ago
    Wait so does this work?
    - hatstand 9y ago
      Should do if you manually patch your local SDK.
- sercand 9y ago
  If you have a Kubernetes cluster you can use https://github.com/PalmStoneGames/kube-cert-manager https://github.com/PalmStoneGames/kube-cert-manager. Certbot (https://certbot.eff.org/ https://certbot.eff.org/) also has several configurations.
- deleted 9y ago
  [deleted]
43224gg252 9y ago
What's the advantage of running the API in google app engine as opposed to a google cloud VM instance that you can just SSH into? Setting up letsencrypt on a VM instance is 10x easier than this (and in my experience everything else you need to do is 10x easier).
- bg0 9y ago
  For a lot of smaller projects, running google app engine is 10x easier (and cheaper) then worry about a VM.
finnn 9y ago
>Sign up to enjoy the full Medium experience. wow fuck medium
RKearney 9y ago
> Done! Your site is now HTTPS protected! Don’t forget to renew your cert in 3 months This is not how Let's Encrypt is designed to work. Manually registering and then deploying a certificate and saying "don't forget to renew" does not make for a particularly high quality post.
- charlieegan3 9y ago
  It's hard to auto renew on GAE; in fact, I don't know how to config auto renew.
  - subway 9y ago
    That's a big part of why this post is disappointing. It may as well be two separate posts titled "how to manually obtain an LE cert", and "how to manually install a cert on GAE". I was excited and thought they'd come up with a way of installing certs into GAE in an automated manner, since that's been the biggest blocker of automated LE usage on GAE.
    - tomasreimers 9y ago
      Thought about automating it with a sequence of API calls (get challenge, automatically create handler, deploy solution, get cert, modify it, upload it). However, Google is working on an automated solution, and I'm not sure deploying something for the intermediate is necessary https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034 (but I still need certs in the intermediate).
  - dagss 9y ago
    It is not GAE but Google Cloud DNS right? So one needs to write a small app that uses that API to answer the challenge.
  - aliasnexus0 9y ago
    SSL certificates can now be updated in GAE using the gcloud command[1]. You could combine that with lego[2] to renew a Let's Encrypt SSL certificate via DNS Challenge to automate the process until native automation is implemented in GAE. [1] https://cloud.google.com/appengine/docs/standard/python/using-custom-domains-and-ssl#transferring_mappings_from_a_serving_certificate_to_a_new_certificate https://cloud.google.com/appengine/docs/standard/python/usin... [2] https://thornelabs.net/2016/11/08/use-lego-gcloud-dns-and-dns-challenge-to-generate-lets-encrypt-ssl-certificates.html https://thornelabs.net/2016/11/08/use-lego-gcloud-dns-and-dn...
bg0 9y ago
Renewing/replacing certificates, especially with App Engine, is the bane of my existence. I couldn't possibly imagine doing this every 3 months. This being said, I appreciate the tutorial.
mikecb 9y ago
Click of a button certs with automated renewal is coming.
- emddudley 9y ago
  Do you have any links with more information on this?
  - advisedwang 9y ago
    https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034
deleted 9y ago
[deleted]
sudhirj 9y ago
The fact that setting up SSL on Google's platform in 2017 requires reading a long article and repeating steps is really bad publicity - if this post is official it ought to be embarrassing. AWS, Heroku, Cloudflare have all moved on to automated certificate management for all their hosted services. http://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html http://docs.aws.amazon.com/acm/latest/userguide/acm-overview... https://devcenter.heroku.com/articles/automated-certificate-management https://devcenter.heroku.com/articles/automated-certificate-... https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
- advisedwang 9y ago
  Looks like it's coming soon: https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034
- tomasreimers 9y ago
  Yup! I even link to the Amazon one in the tutorial, Google's is coming soon (https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034), and in the meanwhile this helps you get a cert.
  - sudhirj 9y ago
    Is this App Engine specific? Or will this also apply to https://cloud.google.com/load-balancing/ https://cloud.google.com/load-balancing/ ?
charlieegan3 9y ago
I wrote up a gist for my own memory: https://gist.github.com/charlieegan3/37c854f50198711a1b5e216b8dd57e99 https://gist.github.com/charlieegan3/37c854f50198711a1b5e216... - it runs certbot in a container rather than installing it. I recently moved my static site from app engine to S3 and cloudfront so I could take advantage of ACM certificates (as well as playing around with some more terraform).
advisedwang 9y ago
Google is going to be providing automatic SSL Certs soon: https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034
superasn 9y ago
Isn't it possible to call a Dns api and Google's Api to set the Txt record in dns and cleanup hook to set the certificates in Google respectively?
- tomasreimers 9y ago
  People have different DNSs. I'm using Namecheap and GAE for example.
jaas 9y ago
"LetsEncrypt issues SSL certificates by automatically verifying that you have ownership of the domain you claim you have." Let's Encrypt does not verify ownership of domains. We verify control. This is a common mistake, but the difference between ownership and control is significant so I'm just pointing this out for general educational purposes.
- tomasreimers 9y ago
  Thank you! Good point.
renaudg 9y ago
For the Container Engine part of GCP (and any Kubernetes installation really), this project automates everything away : https://github.com/jetstack/kube-lego https://github.com/jetstack/kube-lego
- basetensucks 9y ago
  +1 well worth checking this tool out. Saved me a lot of effort setting up a GCP Kubernetes deployment two months ago. So far it has been a matter of set it and forget it.

55 points by tomasreimers 9y ago

danielecook 9y ago

I'm looking for a way to automate the process. Has anyone got any ideas?

hatstand 9y ago
Work in progress but: https://github.com/hatstand/gacertsbot/blob/master/appengine/README.md https://github.com/hatstand/gacertsbot/blob/master/appengine... Currently relies on a fix to the appengine go SDK though: https://github.com/golang/appengine/pull/82 https://github.com/golang/appengine/pull/82
- bg0 9y ago
  Wait so does this work?
  - hatstand 9y ago
    Should do if you manually patch your local SDK.
sercand 9y ago
If you have a Kubernetes cluster you can use https://github.com/PalmStoneGames/kube-cert-manager https://github.com/PalmStoneGames/kube-cert-manager. Certbot (https://certbot.eff.org/ https://certbot.eff.org/) also has several configurations.
deleted 9y ago
[deleted]

43224gg252 9y ago

What's the advantage of running the API in google app engine as opposed to a google cloud VM instance that you can just SSH into? Setting up letsencrypt on a VM instance is 10x easier than this (and in my experience everything else you need to do is 10x easier).

bg0 9y ago
For a lot of smaller projects, running google app engine is 10x easier (and cheaper) then worry about a VM.

finnn 9y ago

>Sign up to enjoy the full Medium experience. wow fuck medium

RKearney 9y ago

> Done! Your site is now HTTPS protected! Don’t forget to renew your cert in 3 months This is not how Let's Encrypt is designed to work. Manually registering and then deploying a certificate and saying "don't forget to renew" does not make for a particularly high quality post.

charlieegan3 9y ago
It's hard to auto renew on GAE; in fact, I don't know how to config auto renew.
- subway 9y ago
  That's a big part of why this post is disappointing. It may as well be two separate posts titled "how to manually obtain an LE cert", and "how to manually install a cert on GAE". I was excited and thought they'd come up with a way of installing certs into GAE in an automated manner, since that's been the biggest blocker of automated LE usage on GAE.
  - tomasreimers 9y ago
    Thought about automating it with a sequence of API calls (get challenge, automatically create handler, deploy solution, get cert, modify it, upload it). However, Google is working on an automated solution, and I'm not sure deploying something for the intermediate is necessary https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034 (but I still need certs in the intermediate).
- dagss 9y ago
  It is not GAE but Google Cloud DNS right? So one needs to write a small app that uses that API to answer the challenge.
- aliasnexus0 9y ago
  SSL certificates can now be updated in GAE using the gcloud command[1]. You could combine that with lego[2] to renew a Let's Encrypt SSL certificate via DNS Challenge to automate the process until native automation is implemented in GAE. [1] https://cloud.google.com/appengine/docs/standard/python/using-custom-domains-and-ssl#transferring_mappings_from_a_serving_certificate_to_a_new_certificate https://cloud.google.com/appengine/docs/standard/python/usin... [2] https://thornelabs.net/2016/11/08/use-lego-gcloud-dns-and-dns-challenge-to-generate-lets-encrypt-ssl-certificates.html https://thornelabs.net/2016/11/08/use-lego-gcloud-dns-and-dn...

bg0 9y ago

Renewing/replacing certificates, especially with App Engine, is the bane of my existence. I couldn't possibly imagine doing this every 3 months. This being said, I appreciate the tutorial.

mikecb 9y ago

Click of a button certs with automated renewal is coming.

emddudley 9y ago
Do you have any links with more information on this?
- advisedwang 9y ago
  https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034

deleted 9y ago

[deleted]

sudhirj 9y ago

The fact that setting up SSL on Google's platform in 2017 requires reading a long article and repeating steps is really bad publicity - if this post is official it ought to be embarrassing. AWS, Heroku, Cloudflare have all moved on to automated certificate management for all their hosted services. http://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html http://docs.aws.amazon.com/acm/latest/userguide/acm-overview... https://devcenter.heroku.com/articles/automated-certificate-management https://devcenter.heroku.com/articles/automated-certificate-... https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/

advisedwang 9y ago
Looks like it's coming soon: https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034
tomasreimers 9y ago
Yup! I even link to the Amazon one in the tutorial, Google's is coming soon (https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034), and in the meanwhile this helps you get a cert.
- sudhirj 9y ago
  Is this App Engine specific? Or will this also apply to https://cloud.google.com/load-balancing/ https://cloud.google.com/load-balancing/ ?

charlieegan3 9y ago

I wrote up a gist for my own memory: https://gist.github.com/charlieegan3/37c854f50198711a1b5e216b8dd57e99 https://gist.github.com/charlieegan3/37c854f50198711a1b5e216... - it runs certbot in a container rather than installing it. I recently moved my static site from app engine to S3 and cloudfront so I could take advantage of ACM certificates (as well as playing around with some more terraform).

advisedwang 9y ago

Google is going to be providing automatic SSL Certs soon: https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034

superasn 9y ago

Isn't it possible to call a Dns api and Google's Api to set the Txt record in dns and cleanup hook to set the certificates in Google respectively?

tomasreimers 9y ago
People have different DNSs. I'm using Namecheap and GAE for example.

jaas 9y ago

"LetsEncrypt issues SSL certificates by automatically verifying that you have ownership of the domain you claim you have." Let's Encrypt does not verify ownership of domains. We verify control. This is a common mistake, but the difference between ownership and control is significant so I'm just pointing this out for general educational purposes.

tomasreimers 9y ago
Thank you! Good point.

renaudg 9y ago

For the Container Engine part of GCP (and any Kubernetes installation really), this project automates everything away : https://github.com/jetstack/kube-lego https://github.com/jetstack/kube-lego

basetensucks 9y ago
+1 well worth checking this tool out. Saved me a lot of effort setting up a GCP Kubernetes deployment two months ago. So far it has been a matter of set it and forget it.