5 ms·

The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Let's e

by tpmx 7y ago

The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Let's encrypt is awesome because it's instantaneous! You'd think Google would understand that aspect. Edit: GCP people: Please give us a an explicit "retry" button to press when we've set up the DNS records. (I'm talking about the Google Cloud Balancing Service here. The UI was awesome up until the point it wasn't. The one thing lacking was a "retry" button.)

sieabahlpark 7y ago
If you use Google cloud enough you'll soon realize they're not very fast at anything. Better hope you don't get your account automatically banned because one of your employees does sketchy things on their own personal account
- tpmx 7y ago
  I think you probably have an unrelated grudge here, at least judging from the contents of your comment before you edited it to make it less offensive.
ZeroCool2u 7y ago
Huh, I've had the opposite experience when setting up DNS on GCP App Engine. Things seemed to be quite snappy to me.
- tpmx 7y ago
  The stars were probably aligned for you. Given DNS TTL there's a bunch of uncertainty here. My main feedback to Google is that having them periodically check back at an unanounced schedule, with no abilitity to force an an immediate check.. shows a total lack of understanding of customer needs. I mean, like... Yes, I understand that by default Google does things at scale, but sometimes you need to do things by precision/on demand, too.
briffle 7y ago
For GKE, in beta, you can tell the ingress to get a TLS certificate automatically. Google will manage the whole process. The weird thing is, it uses letsencrypt. Since Google has their own Root CA, that seemed like an interesting choice. [0] https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs https://cloud.google.com/kubernetes-engine/docs/how-to/manag...
- dannyw 7y ago
  Maybe they don’t have a publicly available issuance (challenge/response, ACME, etc) infrastructure for their Root CA. Or maybe they just want to keep google CA, limited to Google properties. The same way you put things in googleusercontent.com and not google.com.
outworlder 7y ago
> The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Have you noticed where they get the certs from? Let's Encrypt! So there's really no reason for that.

by tpmx 7y ago

sieabahlpark 7y ago

If you use Google cloud enough you'll soon realize they're not very fast at anything. Better hope you don't get your account automatically banned because one of your employees does sketchy things on their own personal account

tpmx 7y ago
I think you probably have an unrelated grudge here, at least judging from the contents of your comment before you edited it to make it less offensive.

ZeroCool2u 7y ago

Huh, I've had the opposite experience when setting up DNS on GCP App Engine. Things seemed to be quite snappy to me.

tpmx 7y ago
The stars were probably aligned for you. Given DNS TTL there's a bunch of uncertainty here. My main feedback to Google is that having them periodically check back at an unanounced schedule, with no abilitity to force an an immediate check.. shows a total lack of understanding of customer needs. I mean, like... Yes, I understand that by default Google does things at scale, but sometimes you need to do things by precision/on demand, too.

briffle 7y ago

For GKE, in beta, you can tell the ingress to get a TLS certificate automatically. Google will manage the whole process. The weird thing is, it uses letsencrypt. Since Google has their own Root CA, that seemed like an interesting choice. [0] https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs https://cloud.google.com/kubernetes-engine/docs/how-to/manag...

dannyw 7y ago
Maybe they don’t have a publicly available issuance (challenge/response, ACME, etc) infrastructure for their Root CA. Or maybe they just want to keep google CA, limited to Google properties. The same way you put things in googleusercontent.com and not google.com.

outworlder 7y ago

> The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Have you noticed where they get the certs from? Let's Encrypt! So there's really no reason for that.