5 ms·
Managed SSL for Google App Engine
- jfoster 9y agoI've tried it and get "Failed to activate certificates" errors.
- thedevil 9y agoMe too. If anyone figures this out, I'd love to hear more.
- lklig 9y agoHello from the App Engine team. Could you double check that your DNS records are accurate? Everything is looking good on our end. Thanks for the feedback!
- thedevil 9y agoThanks for the quick response! I'll double check them later today.
- hinfaits 9y agoI also could not get it to work on two separate domains. Everything seems fine, and I was able to renew the certs with LE just now. I believe all my DNS records look fine, and I have the domain ownership set correctly with GAE. Not sure what else I can change to get it working.
- pg_is_a_butt 9y agosame here... the UI doesn't work. i fell back on LE and generated new certs... hopefully google can work this out in 3 months.
- hinfaits 9y agoSeems to be working fine now.
- AnssiH 9y agoI can also reproduce the issue, i.e. "Failed to activate certificates." a few seconds after clicking "Enable managed security" with 4 domains checked. I checked the DNS records and the CNAME, A, AAAA records of all the domains match exactly what is shown on the admin console.
- thedevil 9y agoI was able to get this to work in the command line (after gcloud components update). This is an exciting feature! Thanks for the support! And thanks for all the good work on AppEngine! And thanks to other commenters too!
- cloudwizard 9y agoAny chance that you will support wildcard domain names?
- StevePerkins 9y agoI was in the preview/alpha/whatever group. Never could get cert creation to work through the console UI, but it worked fine when using the gcloud SDK from the command-line.
- le-mark 9y agoIs this basically just SNI for GAE? Or did they already have that?
- StevePerkins 9y agoIt's basically invisible automation for creating and renewing LetEncrypt certs on App Engine. The traditional process for installing a custom domain SSL cert on App Engine was very clunky. Involved running OpenSSL commands, cut-n-pasting PEM data, etc. If you were using LetsEncrypt, then it was more or less impossible to automate... you had to go through a tedious manual process every 3 months (including updating your app, to respond to the LetsEncrypt verification endpoint!).
- iamgopal 9y agoI think they do not use letsencrypt . They use thier own SSL, since they are now licencing authority. Edit: I am wrong. They use letsencrypt.
- StevePerkins 9y agoI am hosting this project on App Engine, and have been using their SSL management for a couple of months now: https://resumefodder.com/ https://resumefodder.com/ A click on the browser padlock icon says that it's a LetEncrypt cert. Unsurprising, since Google is such a major sponsor. Also unsurprising that Google chooses to focus on their own branding rather than call attention to it.
- iamgopal 9y agoYou are right, I do have many domains and didn't bother to check it.
- AnssiH 9y agoThey did already have that. This is fully automatic SSL management for your own domains that point to Google App Engine, with certs managed by Google. Previously you had to use your own certs and manually upload them through the UI (or via the beta API, which is also now in general availability). edit: managed, not provided, the certs are actually Let's Encrypt
- OzzyB 9y agoThis is a welcomed addition that many have been patiently waiting for. If you want to see the progress here's the relevant ticket[0] -- nice to see it finally closed! Not privy to the final implementation details but my guess it's a based on Let's Encrypt as suggested by the originator of the ticket and others. Edit: Yeah, probably not Let's Encrypt as others have stated. [0] https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034
- iancarroll 9y agoGoogle purchased its own root CA from GlobalSign, so I’d assume it’s coming from there instead.
- ngrilly 9y agoI guess it's based on Google's own Certificate Authority, instead of Let's Encrypt, according to this: https://security.googleblog.com/2017/01/the-foundation-of-more-secure-web.html https://security.googleblog.com/2017/01/the-foundation-of-mo...
- ngrilly 9y agoFor the record, I guessed wrong. I enabled the feature and checked the certificate: it's based on Let's Encrypt ;-)
- darshan 9y agoI turned this on today via gcloud, and the certificate I was issued is from Let's Encrypt.
- nyrikki 9y agoIt is Let's Encrypt, I just converted my test project so that I could kill the Jenkins job to update the Cert. Issued By Common Name (CN) Let's Encrypt Authority X3
- paulddraper 9y agoBeen using AWS's certificate management. It is _so_ nice not to (1) manage the certs with your own infrastructure (2) automatically deploy these things to HAProxy, Apache, MySQL, random server X. Automated load balancing + cert management is heaven.
- kuschku 9y agoI'm using kubernetes with kube-lego, and my experience is exactly the same. Automating all routing, API gateways, TLS termination and certificate management makes life so much easier.
- _asummers 9y agoMy hope is that this makes kube-lego unnecessary for kubernetes! Being able to get a cluster spun up with TLS by default would be amazing.
- zackify 9y agoAny plans to add this to storage buckets?
- NearAP 9y agoThis is welcome news. This means I no longer have to track and manually renew my Let's Encrypt certificates for my websites. I also see it as a way to incentivize folks to use GAE (not only are you getting free quotas to run your app, you also don't have to spend money to buy certificates and don't have to worry about installing or renewing them). Finally, I also see it as another way of pushing for the uptake of SSL. With GAE doing this, other hosting services might also start offering something similar or close to it which would then beg the question - why is your site not using SSL.
- joshribakoff 9y agoThe whole premise behind letsencrypt is the ACME protocol, so you don't have to manually renew certs [although you can]. The problem is in handling SSL renewals on a cluster, you have to do renewals via DNS & rsync certs around, and there's not many tools to do this. But for a single server, its very easy to automate. Another problem with letsencrypt is the rate limits & such.
- bckygldstn 9y agoGoogle App Engine only a few weeks ago released an API for managing certificates. Before that, the only way to add or update a certificate was to manually paste the key into a web form.
- andy_ppp 9y agoIf using docker you can mount a volume to your let’s encrypt certs on all your frontend servers.
- daave 9y agoAgreed this is super-exciting. Hope they add the same functionality for Google Cloud HTTPS Load Balancers soon as well.
- mchristen 9y agoAWS has been offering free SSL certs for a year now, happy to see Google following their lead.
- ohstopitu 9y agoThis is great news. I love app engine but one of the biggest issues I've had with it is the fact that memcached and search are not available for anything but app engine standard - python (2.7). Providing access to both via app engine flexible would be god sent!
- benguild 9y agoWe use memcache but it’s really unreliable. I recommend rolling your own anyway. Also I think there is an alpha for flex?
- joshribakoff 9y agoI feel like Google isn't exactly the best place to get your SSL, given their track record with the NSA.
- sofaofthedamned 9y agoReally?
- iancarroll 9y agoIf you are using App Engine, Google is terminating the TLS connection regardless...
- joshribakoff 9y agoRight... Which is all the more reason not to let them issue your SSL cert, or terminate your SSL for that matter.
- iancarroll 9y agoYour issue is then with using App Engine, not with them giving you a certificate. There is no way to use App Engine without them getting the plaintext in the end.
- syntaxgoonoo 9y agoWhen will Azure do the same?
- partiallypro 9y agoThey do offer it for webapps using Lets Encrypt, but nothing else afaik. But I look forward to it being added, it is definitely needed. Even setting up the Let's Encrypt to auto renew is a very tedious process.
- bmizerany 9y agoHello from Backplane. You can get this on Azure today using https://www.backplane.io https://www.backplane.io with end-to-end encryption to your backends plus a huge chest of other routing and security features. It's free to start. I'm blake at backplane dot io
- kennethh 9y agoIs this both for App Engine standard or flexible environment also?
- lklig 9y agoBoth environments are supported!
- nivertech 9y agoCan this be used with load balancers on GCE?