17 ms·

Automate Public Certificates Lifecycle Management via RFC 8555 (ACME)

321 points by tvvocold 5y ago

binwiederhier 5y ago
That's great. Though maybe the title should acknowledge that it's only for Google Cloud customers. It's also quite odd that the article doesn't mention Let's Encrypt or the ISRG at all. I would have expected some sort of acknowledgement to their fantastic work over the years.
- XorNot 5y ago
  Also because up till, I guess now, Google Cloud TLS is just LetsEncrypt. Which does raise an issue: I'm not sure why you'd use this, given Google's history of killing projects. What's the compelling reason to switch - especially since they feel content to release this under the `alpha` command set for the CLI tool.
  - KennyBlanken 5y ago
    Don't forget the "going to the store for some milk" phase of google products where for a few years it doesn't get any feature additions or bugfixes. I don't understand why anyone would go for this given LE is mature, stable, trusted, and well-supported. Say one day it just stops issuing you new certs; now what? Call someone? Nope. Post in the forums? Not unless you want to get asked if you've cleared your Chrome cache.
    - seized 5y ago
      The reason may be so that services on private subnets don't need internet access to use Let's Encrypt. Just a guess though.
      - jclulow 5y ago
        You don't need direct Internet access to use Let's Encrypt, as long as you can arrange for the challenge response to appear in public DNS under the name you want to use.
        jyrkesh 5y ago
        Would you mind giving an example of what that might look like? Or linking to something? I've always struggled with needing to open ports temporarily on stuff behind my own reverse proxy to avoid passing the certs by hand, and it sounds like something that'd be useful to understand.
        mcpherrinm 5y ago
        The magic phrase is “DNS-01” challenge. You place a DNS TXT record to validate control of the domain. There are lots of ACME clients that support a wide variety of DNS service providers. For example, I have a Home Assistant server which automatically issues certs using Gandi DNS and the HA Lets Encrypt support, all without being on the internet (except for the DNS entries)
        tetha 5y ago
        It's the DNS-01 challenge[1]. This reduces the challenge to using some DNS provider with an API supported by a client[2] / [3], as well as the server needing to be able to reach the LE-API. We use this with the CNAME delegation into an irrelevant zone everywhere to get wildcard certificates for our LBs ( meaning: the _acme_challenge.example.com record is just a CNAME for _acme_challenge.dont.ever.use.this.example.com, and the servers just have credentials to modify records in the zone <dont.ever.use.this.example.com>) 1: https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... 2: https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins https://eff-certbot.readthedocs.io/en/stable/using.html#dns-... 3: https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi
        spockz 5y ago
        The acme client needs to reach LE though. Or you need to do a dance where the client is outside of the private network and ships the certificate into the private network.
    - fomine3 5y ago
      LE has compatibility issue with very old Android/OpenSSL. https://community.letsencrypt.org/t/production-chain-changes/150739 https://community.letsencrypt.org/t/production-chain-changes... Possibly Google's cert doesn't have the issue?
      - kijin 5y ago
        Yeah, that transition didn't go as smoothly as they might have hoped. Most of us first-world programmers can just shrug and say "don't use unsupported versions," but I've had multiple non-technical clients call me up urgently and ask why a (relatively small, but not insignificant depending on the market, and definitely not in their control) subset of their users were seeing certificate errors. So I don't recommend LE to my clients anymore. But it's a hassle to buy certificates the old way after having tasted ACME, so I'm always looking for an ACME-compatible alternative. ZeroSSL is backed by a more conservative Sectigo CA, but its ACME endpoints aren't very reliable. If this Google cert becomes widely available, I might just as well switch to it. :)
        pronoiac 5y ago
        From memory, ZeroSSL also gets expensive after a couple of domains, and I had issues using certbot rather than acme.sh with it.
        kijin 5y ago
        Nowadays you can get virtually unlimited 90-day certs from ZeroSSL if you use ACME through the EAB feature rather than using their API. But their ACME support seems half-hearted at best. The endpoints often return errors for no reason, compatibility with clients is hit-and-miss, and they keep spamming you with renewal notices even if you renew the cert. For important domains these days I just get a cheap 1-year DV cert like the good ol' days.
    - jfoster 5y ago
      Funny you should mention about the forums. There's been a fairly notable Chrome issue intermittently affecting users on MacOS X since late last year and Google seem oblivious to it. https://support.google.com/chrome/thread/135844398/chrome-isn-t-allowing-me-to-attach-files?hl=en https://support.google.com/chrome/thread/135844398/chrome-is... So, yeah... I don't want to depend on a free Google Cloud account for SSL.
  - ricktdotorg 5y ago
    i am pretty certain (but happy to be corrected) that Google has never killed a GCP service that paying customers are using. Google != Google Cloud Platform
  - rapnie 5y ago
    > Which does raise an issue: I'm not sure why you'd use this, given Google's .. the biggest advertising giant on the planet that sucks up as much data as they possibly can about their subjects. > What's the compelling reason to switch
  - Thorrez 5y ago
    >up till, I guess now, Google Cloud TLS is just LetsEncrypt. Google Cloud has been issuing certs for customer use off its own CA ( pki.goog ) for a while. It went GA April 27, 2020: https://cloud.google.com/load-balancing/docs/release-notes#April_27_2020 https://cloud.google.com/load-balancing/docs/release-notes#A... You can see the documentation here: https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs https://cloud.google.com/load-balancing/docs/ssl-certificate... GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Or you can restrict the load balancer to just get certs one of them by using a DNS CAA record. Up till now, you could only use pki.goog with GCP load balancers. This new release allows pki.goog to be used with anything, because you actually control the private key. Disclosure: I work in Google Cloud.
    - francislavoie 5y ago
      > GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Awesome, glad to see other ACME clients using issuer fallback, like Caddy does! Do you know if there are any plans to making the Google ACME CA usable without registration? Having to register for an account and using credentials is a huge barrier to entry for many less-technical users. Caddy is able to use LE and ZeroSSL because they both don't _require_ accounts (ZeroSSL recommends it, partially as an upsell, but it's not necessary). The more no-registration CAs exist, the more resilient ACME clients can be.
      - Thorrez 5y ago
        Sorry, I don't know the plans. I don't work on that team.
    - XorNot 5y ago
      Mid-year 2020 is not what I'd call running a service for "a while". That means its been GA just long enough to drop out of college.
      - Thorrez 5y ago
        You could drop out after one day. If you drop out fast enough you might qualify for a refund. I heard of someone who enrolls in a community college every winter, then goes skiing on a student discount, then drops out quickly and gets a refund. Not very ethical... Sorry, this was completely unrelated to your point.
  - blackoil 5y ago
    If you are worried about `Google's history of killing projects`, you will anyway not be on Google Cloud.
- lights0123 5y ago
  > only for Google Cloud customers for which there's no payment required as far as I can tell—just creating a Google Cloud account.
  - mcpherrinm 5y ago
    I think you do have to have a payment card on file, even if there’s no payments to be made.
    - onion2k 5y ago
      ... which is how they connect your account to who you are (or who you work for), so they can extract value from your social graph instead. As the adage goes, if it's free you are the product, not the customer.
      - derefr 5y ago
        GCP, AWS, other IaaS providers, and more generally, any "post-paid" service company, needs your credit card, because the services these providers provide allow users to generate costs that can only be measured after-the-fact; and where those costs greatly exceed the free-plan limits, the provider wants to be able to pass those costs to the user. As well, post-paid providers rely on credit-card billing information to deduplicate/KYC users. Without this sort of information, an, er, "ingenious" user could just sign up for a million free-tier accounts and lash them together into a quota-evading resource-sucking behemoth.
        onion2k 5y ago
        Sure. All that is true. And the credit card number ties your free GCE account to your profile with credit agencies that ad companies use to improve their targeting. It's not one thing or the other. It's both.
        derefr 5y ago
        Do you think it's really that valuable for Google to spend engineering hours on an ad-targeting integration that will only improve targeting for maybe ~100k users at most? And probably far less, actually. As many GCP users as there might be in the world, most of them are IT staff working for some-or-another enterprise; where that enterprise only has a single GCP billing-account administrator. Nobody else in the enterprise has their card on file. (And that billing-account administrator's card-on-file is just a corporate credit card, that tells you what the corporation buys, but tells you nothing about the individual. And their email is just a group/alias — billing@ or somesuch. Impossible to log into; impossible to browse the web as; no way to target ads at.) You'd think the long tail of individual accounts could have more value, but those are the same users who GCP is least interested in recruiting to their platform, and the ones whose entered data is least trustworthy, because of all the spammers and crypto-miners attempting to use stolen credit cards to pay for service. You want to bind some poor random Joe's card-hubbed ad-profile to a spoke created by the person who stole their identity? That's negative average ad-targeting ROI!
- aaomidi 5y ago
  It uses google cloud binding, but you can request and use these certificates from any system.
- notatoad 5y ago
  >I would have expected some sort of acknowledgement to their fantastic work over the years. i think their platinum-level sponsorship of the ISRG is probably more meaningful than a shout-out in a blog post.
  - binwiederhier 5y ago
    That's actually a really good point. Though sometimes words are of acknowledgement are equally important. Likely not here though. I'm sure they'd rather take the money ;-) Side note: I'm actually so proud that my company, Datto, has also been sponsoring Let's Encrypt for many years, and that I was the one to suggest it. It's not platinum, but it's still $50k per year.
    - lnxg33k1 5y ago
      Can you guys send an email to Atlassian?
    - cpach 5y ago
      That’s not peanuts indeed. Well done, Datto!
    - Narkov 5y ago
      Well done Datto! Thanks for supporting the Internet.
    - notatoad 5y ago
      yeah, words of encouragement can be great, but i don't think anybody at LetsEncrypt is in any doubt that Google is happy with the work they are doing. also, i get the sense that getting wider adoption for FIDO outside of LetsEncrypt is a bit of a goal, so having a third-party announce support for FIDO without referring to it as "the LetsEncrypt protocol" is kind of a win for the FIDO people.
  - deleted 5y ago
    [deleted]
  - ljm 5y ago
- yjftsjthsd-h 5y ago
  Oh, so they've achieved parity with AWS. That's still nice, if not particularly impressive.
  - INTPenis 5y ago
    Well sort of. Using ACME means you're not locked into AWS API.
    - deleted 5y ago
      [deleted]
  - rmhrisk 5y ago
    No, GCP has had arguably a superior TLS story for years. For example they do managed TLS for their workloads like AWS but they operate their own CA rather than outsourcing to Digicert for certificate issuance which gives them a better SLA. They have a global load balancer offering that enables TLS to terminate everywhere GCP is without having to manage a bunch of discrete load balancers, this also supports managed TLS. They now support a very large number of certificates in the global load balancer product which allows SaaS products like hosting services to leverage the global load balancer rather than deploying a load balancer per 25 certificates (the limit per AWS LB). And now let you enroll for certificates from the same CA they use even if you terminate TLS rather than having them do it for you. They do this via a standard API (ACME) which lets you have uniform and agile device compatibility regardless of how you deploy TLS. AWS doesn't let you do this at all. (I should note I was the PM for most of these releases and am still the PM for Google Trust Services the CA used for this ACME release)
- winternett 5y ago
  And that they're using chrome browser to make certs a mandatory and increasingly expensive monthly subscription service for site owners even though for many sites that don't handle secure transactions it really shouldn't be a requirement. In 2026 only rich companies will be able to maintain sites with the way we're going folks.
  - charcircuit 5y ago
    Certs are free. What do you mean monthly subscription? Also why would secure transactions be necessary? Preventing third parties from injecting ads / mining scripts / phishing logins benefits all sites.
  - mosen 5y ago
    LetsEncrypt is free.
  - otterley 5y ago
    SSL certificates are cheaper than most DNS domain renewals are. ssls.com has them for as low as $3.88 per year; and you can use Let’s Encrypt for free.
- noway421 5y ago
  Quite odd indeed, maybe there are some legal reasons not to mention it. If they could, I feel the whole article could be condensed to "we just shipped a LetsEncrypt alternative gated to Google Cloud customers".
- snickmy 5y ago
  On this note, I wonder if there is any way to get a google cloud account, and use it JUST for this, without any $$. I don't think so, right? because best option you still need some sort of reverse proxy to your own server?!
  - Ayesh 5y ago
    As far as I can tell (I now have the API access, so I might test later), you only need to provide additional authentication credentials to Certbot. The private key stays on your server. The CA server _might_ reject requests that do not come from GCP, or attempt to obtain one for a domain name not setup with GCP.
    - rmhrisk 5y ago
      There is no origin limitation. It works on premise or cross cloud.
- tialaramex 5y ago
  It probably doesn't mention Let's Encrypt because that's an extra opportunity for confusion since you do not (usually?) get Let's Encrypt certificates from this service. This service has nothing to do with Let's Encrypt, you get certificates from GTS, so the connection would be that ISRG / Let's Encrypt was part of the work to develop ACME and so on. But that's increasingly ancient history. The goal of the work was that almost all CAs in the Web PKI would offer ACME (the people doing like a dozen issuances per month maybe not, but there's an open question about whether they should even exist) -- not just this one free service operated by a charity and here Google are following through. I'd say that it's the same as if Zig announces each new compiler version or whatever and doesn't acknowledge that, yeah, Grace Hopper is in some sense responsible for the idea of compilers. [[ Hopper wrote the first "compiler" although today we would not consider her software to be a "compiler" but maybe a loader/linker. Anyway, the whole practice of having the machine do the boring job of writing machine code while a human just expresses what they wanted is down to Grace. Thinkers like Turing would have known this was possible in theory but Grace wasn't writing theory, she was doing engineering. ]]. Grace Hopper is important and worth celebrating, but it would be weird to insist on making a specific programming language that has nothing to do with Grace mention her every release. I guess if you're an Oscar's speech writer going for that "I want to thank my parents, without whom I wouldn't be here today" vibe, then yeah. But otherwise it seems unnecessary.
- mikomikarro 5y ago
  Nice!
_yoqn 5y ago
Who would trust Google with their infrastructure these days anyway? Personally I do need to work with Google services occasionally but always experience default anxiety about it.
- antonvs 5y ago
  We run our company on Google Cloud, spending about $400k a year on it. I previously worked heavily with AWS. From a technical perspective Gcloud is pretty great. People's saltiness about the consumer/advertising side of Google having killed their favorite free product is pretty irrelevant in this context.
  - nicce 5y ago
    I wouldn’t say irrelevant as this is free service as well and same people are making decisions in upper management. There is always a catch and they don’t make anything if it is not bringing more revenue.
    - antonvs 5y ago
      This is a free feature on GCP. Many features on GCP are free because they're bundled into the pricing. > same people are making decisions in upper management. That's not true. Google Cloud has its own CEO and a very different business model. > they don’t make anything if it is not bringing more revenue. Sure - they're a for-profit business. Google Cloud's revenue was $13bn in 2020, and as of last quarter it had a run rate of $22 bn. That money comes direct from paying customers. The business model of the consumer/ad side really is irrelevant here.
      - nicce 5y ago
        > That's not true. Google Cloud has its own CEO and a very different business model. Business model is different indeed, but the parent company is still Alphabet, which in the end has huge influence.
        5y ago
vmception 5y ago
Double dare you to use and rely on that
- deleted 5y ago
  [deleted]
paxys 5y ago
*For Google Cloud customers. Not exactly "free" when you are required to pay into the ecosystem.
- garaetjjte 5y ago
  I don't think you need to pay anything for Google Cloud account, no?
  - jvolkman 5y ago
    That's right. I've had a tiny vm running for years and have never paid anything.
    - ipaddr 5y ago
      But they hold your credit card and you gave them permission to bill you if you get more traffic
      - jvolkman 5y ago
        There are ways to automatically kill billing (and thus service) on a project in response to cost overruns.
        teleforce 5y ago
        Please share the ways, thanks.
        jvolkman 5y ago
        I was thinking of this example: https://cloud.google.com/billing/docs/how-to/notify#cap_disable_billing_to_stop_usage https://cloud.google.com/billing/docs/how-to/notify#cap_disa...
        tialaramex 5y ago
acutesoftware 5y ago
That's great, and I am sure it is cool, but I don't trust Google to keep products maintained any more. I won't be trying it out.
- deleted 5y ago
  [deleted]
steveneo 5y ago
When google announces a new product, the first thing I think about is always when that product will be shut down.
- threatofrain 5y ago
  Does Google have a reputation of shuttering their paid products?
  - jfim 5y ago
    On the consumer side of things, they have. Nest guard has been discontinued, and Google play music has been replaced by YouTube music, which lacks some of the features of its predecessor.
  - ipaddr 5y ago
    This is a free product. They have a reputation for shutting down anything and everything including some paid products.
    - antonvs 5y ago
      It's a free feature on GCP. Lots of things on GCP are free, because they're bundled into the overall pricing.
  - adrr 5y ago
    We were on Google Hire when they shut it down.
  - bruce511 5y ago
    Google maps api got a 7000% price increase. So, not shuttered but....
- ttty 5y ago
  Not only that, if they charge and you dispute any payments they might ban your account. (This service requires a credit card )
- deleted 5y ago
_nickwhite 5y ago
Sorry, you’re too late. Already discontinued. Obviously kidding! Glad to see this brought online for GCP customers.
- deleted 5y ago
  [deleted]
bruce511 5y ago
The article has been on HN for an hour. It has 8 comments, 5 of which were my first thought - why on earth would you expect this service to hang around, based on Google's track record? Wether it lasts or not, this surely has to be an issue for Google innovations going forward? If the perception is that any new thing will die, especially not-consumer-scale things, then how do they build traction?
- refulgentis 5y ago
  The people who believe this are going to keep believing it, there's not really anything to dissuade them. A priori anything might be cancelled could be and is worthless. Most don't have that extreme of a position, Reader and Allo were the last big deprecations.
  - inlined 5y ago
    I can’t think of a single google cloud product that’s gone GA and then been shut down. Google has different attitudes towards consumer and enterprise products.
    - pxeboot 5y ago
      Google Cloud Print was shutdown [1]. [1] https://www.google.com/cloudprint/learn/ https://www.google.com/cloudprint/learn/
      - jvolkman 5y ago
        Despite the name I don't think that was actually part of GCP.
      - seized 5y ago
        I was salty about that too, but it wasn't a Google Cloud Platform (GCP) product. It just had cloud in its name.
      - jrockway 5y ago
        That's just poor branding. Google Cloud Print was not part of Google Cloud Platform. (I feel like Google just doesn't understand branding. I remember when they launched the Pixel C after the Chromebook Pixel, and it ran Android instead of ChromeOS. What was once a Chrome brand became an Android brand. I guess because Chrome was doing pretty well at the time, and Android just reminded people of slow phones that ran out of battery instantly. Sigh!)
deleted 5y ago
[deleted]
alfiedotwtf 5y ago
I found this article via Google Reader
- deleted 5y ago
  [deleted]
Jac1 5y ago
- inlined 5y ago
  Is thiS supposed to be some Loony Tunes joke? ACME is the name of the protocol.
  - schoen 5y ago
    The Let's Encrypt community also made some fun references to the Roadrunner cartoons in the early days. (1) The reference implementation of the ACME server was originally going to be called Anvil, but was renamed to Boulder. (A later lightweight testing implementation is called Pebble.) (2) A later ACME client was called "dehydrated", after, well, take a look: https://github.com/dehydrated-io/dehydrated https://github.com/dehydrated-io/dehydrated (3) I'm pretty sure I'm forgetting another roadrunner joke here somewhere
    - Jac1 5y ago
      And given the tendency towards self owns in the certificate side of administration, a little bit of self awareness in the naming is called for. Pop culture has a way of distorting mental connections, and marketing should be aware of that.
woleium 5y ago
Surely this is just google derisking an external dependency (letsencrypt), so they have full vertical integration, no?
- foepys 5y ago
  At least cloudflare and AWS have been doing this for a very long time. Only they weren't using ACME but their own proprietary APIs where you couldn't export the private keys to you own server. Considering Google requires you to have a GCP account, I don't think it's actually very different and they only wanted to save costs by not developing more customer tooling.
robertwt7 5y ago
so it's only free for GCP customers..
upsidesinclude 5y ago
"FREE"
- deleted 5y ago
  [deleted]
yonran 5y ago
How do these certificates compare against letsencrypt on the technical dimensions? e.g. certificate chain size, rate limits, whether every certificate is published to the certificate transparency logs, what OSs the root CAs are compatible with?
- kyrra 5y ago
  Googler, opinions are my own. I know nothing about this project, but I've had to deal with Google certs a few times. It sounds like the roots are the ones that Google uses to sign it's own domains (like Google.com), which are these: https://pki.goog/repository/ https://pki.goog/repository/ So likely support for them is fairly broad.
  - tannhaeuser 5y ago
    Isn't it odd that Google would sign their own domains? After all, https is about ensuring your sites's authenticity to your visitor via a trusted third-party certificate. This sounds like it's mostly there to make it difficult to modify content by intermittent parties, such as ads and tracking added by your ISP. As such, "self-signing" by your own root CA would appear as a conflict of interest, and only add to SSL enforcement increasingly seen as gatekeeping.
    - perlgeek 5y ago
      It doesn't really matter which CA signs a certificate, as long as that CA is in the trust root of all major browsers and other clients. Which is the case for google's CA.
    - zinekeller 5y ago
      > After all, https is about ensuring your sites's authenticity to your visitor via a trusted third-party certificate. No longer especially that pre-LE, those same third-party sites already broke the rules, even with their EV offerings. Everything has been reduced to "is this domain at least controlled by them?" which is easily auditable (organisational verification has been significantly devalued). Now, Let's Encrypt only verifies domains and not trustworthiness (in fact, they won't revoke certificates known as phishing sites). Also EV certificates are nearly worthless unless you want to bypass many antivirus' HTTPS interception.
Zhenya 5y ago
Is this free like custom domain for gmail free? yeesh
- BLKNSLVR 5y ago
  I'm as salty as the next person about the ending of the free custom-domain gmail service, but it did last for over 10 years, which is plenty of time to get double ROI for the time and setup investment of the free google solution, and then the replacement solution if / when google rug-pulls the "free" component. The equation does change if there are value-adds that start getting offered and used which make it more difficult to transition elsewhere (with docs, gdrive etc. being examples of value-adds for the free custom-domain email offering).
- deleted 5y ago
  [deleted]
jiggawatts 5y ago
The big benefit of ACME is that it verifies domain ownership at the correct level. DigiCert and the like will typically require domain verification at the TLD+1, which is meaningless gibberish that isn't even remotely an RFC standard. There's no such "concept" in DNS, which is intended to be delegated. So for example if I'm tasked with deploying a web app to "dev1.app.project.org.parentcompany.megacorp.co.uk" where the "project team" is based out of -- say -- Australia, then DigiCert will insist that I verify that I own "megacorp.co.uk", which... I don't. The parent company might not either. MegaCorp's UK head office does. They've never heard of me, and it'll take me a month to get through to someone who cares about my tiny, outsourced project down under. This kind of thing has happened to me repeatedly across both corporate and government projects. A 2-week project can have a 1 month delay added to it because of this. ACME gets it right, and nobody else does.
- justin_oaks 5y ago
  I encountered the same problem with DigiCert. I was trying to verify ownership OF A SUBDOMAIN (e.g. sub.example.com) and I was given a TXT record to add to my DNS. I added it to the subdomain sub.example.com but the verification kept failing. It wasn't until I added it to my domain (example.com) that the verification succeeded. Who thought that was a good idea? It was especially frustrating since I had verified ownership of the domain minutes before. Why do I have to do it again for every subdomain?
- derefr 5y ago
  My understanding with how TLS was originally intended to be modelled, is that Certificate Authority-ness was supposed to be delegated as well; or at least, more and smaller entities were supposed to be CAs. (About the same kinds of entities who got IPv4 /8 allocations, really.) Big companies like Microsoft were definitely supposed to be their own CAs, enabling them to assert the authenticity of their own zones' subdomains' certificates without the help of any external CA. Generic commercial CAs were supposed to be for the use of regular contractors, not enterprise megacorps. For some reason (probably industry collusion), X.509 Name Constraints were there from the beginning to enable an extensible generalization of this, but we really missed the boat on supporting them, until eventually doing so became very very hard. We're still making progress toward enablement, though!
PaywallBuster 5y ago
Where can I see the rate limits?
ck2 5y ago
Would that be like the "free for life" google gsuite accounts that are ending next month? Do not rely on any "free" google product you aren't willing to pay for.
lanbanger 5y ago
April 2023: Google announces end of free ACME server
- deleted 5y ago
  [deleted]
jesprenj 5y ago
> Do you issue certificates for punycode encoded Unicode domain names? > Not at this time. I thought punycode solved all integration issues and is meant to be backwards compatible ...
- deleted 5y ago
  [deleted]
- pilif 5y ago
  It is backwards compatible, so this tells me that they added an additional check to prevent certificates for such domains to be issued. I think this is a security measure that prevents people from getting certificates for homoglpyh domains. Browsers already offer some protection, but why not add an additional layer?
  - vbezhenar 5y ago
    This is not protection. People will get it from letsencrypt or any other CA.
    - pilif 5y ago
      yes, but google will be spared the bad press when this issue goes through the press again as it seems to happen every few years.
- deleted 5y ago
  [deleted]
sydbarrett74 5y ago
INTPenis 5y ago
We've had an internal ACME server at my dayjob for over a year now. It's one of the few things I'm proud of where we really got out early on a cool technology. Otherweise we're a big telco and move like a oil tanker.
midrus 5y ago
Wile E. Coyote will be so happy with this.
theptip 5y ago
This is great news. One limitation with Lets Encrypt is their rate limits are a bit low for Review Apps - you can’t issue more than 50 certs a week under a given domain. So if you’re spinning up tens or hundreds of review apps per day, you can’t get a fresh cert for each, and so you need to do something different than your production environment does. (A wildcard cert is the obvious choice.) I hope this offering has a high enough quota that you can get enough certs to do review apps properly; the marginal cost to Google per customer is probably negligible, whereas LetsEncrypt doesn’t have other revenue generating offerings they can use to cover their operating costs.
- bruce343434 5y ago
  I thought letsencrypt offered wildcard certs?
  - theptip 5y ago
    Yes, they do. But if you use a wildcard cert for your review app, then you are not testing the same cert machinery as your production application. (Unless you want to use wildcard certs for your prod app too, which I'd rather not do.)
- paulgb 5y ago
  What’s a “review app” in this context? Are you talking about instances spun up to preview/review a pull request?
  - theptip 5y ago
    Yep, Review Apps are spinning up a full copy of your application per PR. https://docs.gitlab.com/ee/ci/review_apps/ https://docs.gitlab.com/ee/ci/review_apps/ As part of my pre-merge pipeline I deploy the application to k8s, create a public IP, DNS entry from the branch slug, TLS-to-the-pod with wildcard cert, and then run the full end-to-end test suite. If you get your docker caching right, it can be as little as a couple minutes to deploy the whole stack This makes it a lot easier for engineers to iterate on their changes with stakeholders, not to mention it lets you test infra and API changes before actually merging them. We got to tens of engineers using this, so I didn't optimize utilization heavily; this ends up being a bit expensive, but I think worth it.
alpb 5y ago
One major problem with Google’s L7 load balancers is that the config changes take 5-20 mins to take effect. So google trying to set up an ACME challenge on a LB, solving it, and setting the managed TLS cert on it can take non-negligible time (15-30 mins?). I hope this gets fixed someday.
- egberts1 5y ago
  HTTP caching is probably and should be turned off when accessing a specific subdomain for ACME challenge (at Google reverse proxy level), I think. One should not have to do anything extra unless the requester too also run a load balancer in front of their subdomain in question. That’s why ACME challenge offers several different type of protocols (to get by the many caching servers.
- rmhrisk 5y ago
  With the recent GCP Cloud Certificate Manager release the global propagation time is minutes. (I should note I was a PM for this feature)
midjji 5y ago
"Free"
miked85 5y ago
It really would be a mistake to trust your business with a Google product in general, especially a "free" one.
- deleted 5y ago
  [deleted]
aaronchall 5y ago
I recall stories of Google arbitrarily declaring users persona non grata, ruining the user's business and even their life, with no recourse. Is this another such risk vector?
- pilif 5y ago
  > Is this another such risk vector? no because there are other CAs which offer support for the ACME protocol. That's the good thing about open standards.
elcomet 5y ago
Previous title was much better @dang
- deleted 5y ago
  [deleted]
egberts1 5y ago
Q: Do you offer certificates from a pure ECC based certificate chain? A: Not at this time. I see what you did there.
JoachimS 5y ago
Will it bring in advertising dough? If not, possibly reserve a spot here: https://killedbygoogle.com/ https://killedbygoogle.com/
- deleted 5y ago
  [deleted]
vbezhenar 5y ago
Another ACME alternative to letsencrypt is zerossl. It's especially great because letsencrypt is operated by US company ISRG and zerossl seems to be from Austria, so if you're not happy with your server being dependant on US, it might be a good option.
- notsound 5y ago
  Buypass also runs a free acme program. https://www.buypass.com/products/tls-ssl-certificates/go-ssl https://www.buypass.com/products/tls-ssl-certificates/go-ssl
- cm2187 5y ago
  Though migrating to a different CA on a short notice shouldn’t be too hard.
frankfrankfrank 5y ago
Speaking of which; is anyone else old enough to remember when it was discovered that all (Root) Certificate Authorities were compromised by the 5+1 eyes?
- rwiggum 5y ago
  Can you say more about this or point to a source? I'm very curious to learn more about this!
bogomipz 5y ago
From the FAQ: >"Each of these have different scenarios where their use makes the most sense, for example TLS-ALPN-01 might make sense in cases where HTTPS is not used and the requestor does not have access to dynamically update DNS records." I'm confused by TLS-ALPN-01. I understand the idea of using certs for domain verification but if there is no TLS in use how does the client verify this after the cert has been issued exactly?
- zinekeller 5y ago
  This is usually used by TLS terminators, which don't have an HTTP server available (can understand TLS but not HTTP). ALPN here is a property of TLS ClientHello which specifies the capabilities of the client, usually used to signal support for HTTP 2 but in this specific case signals that the TLS client is an ACME verier on behalf of a CA, so the TLS server only sends the validator certificate when the validators specifically requesting it (ensuring interruption-free validation). The important part here is that a TLS server is available but HTTPS is not available as it is either only a TLS terminator or something that operates a non-HTTPS TLS server (for example, RTMPS).
  - bogomipz 5y ago
    >"The important part here is that a TLS server is available but HTTPS is not available as it is either only a TLS terminator or something that operates a non-HTTPS TLS server (for example, RTMPS)." That makes good sense. Thanks for putting it so succinctly. Cheers.
Tobu 5y ago
Any status for RFC 8657, ACME CAA support? This is for restricting which account and which validation methods may issue certificates. The CPS says they may use it, which is too vague and I'm not going to test it right now. https://www.rfc-editor.org/rfc/rfc8657.html https://www.rfc-editor.org/rfc/rfc8657.html https://pki.goog/repo/cps/4.7/GTS-CPS.pdf https://pki.goog/repo/cps/4.7/GTS-CPS.pdf
- Tobu 5y ago
  By the way, I appreciate the support for short-term certificates as well; Letsencrypt doesn't have it, though invalidation can be detected with OCSP or draft-aaron-acme-ari.

321 points by tvvocold 5y ago

That's great. Though maybe the title should acknowledge that it's only for Google Cloud customers. It's also quite odd that the article doesn't mention Let's Encrypt or the ISRG at all. I would have expected some sort of acknowledgement to their fantastic work over the years.

XorNot 5y ago
Also because up till, I guess now, Google Cloud TLS is just LetsEncrypt. Which does raise an issue: I'm not sure why you'd use this, given Google's history of killing projects. What's the compelling reason to switch - especially since they feel content to release this under the `alpha` command set for the CLI tool.
- KennyBlanken 5y ago
  Don't forget the "going to the store for some milk" phase of google products where for a few years it doesn't get any feature additions or bugfixes. I don't understand why anyone would go for this given LE is mature, stable, trusted, and well-supported. Say one day it just stops issuing you new certs; now what? Call someone? Nope. Post in the forums? Not unless you want to get asked if you've cleared your Chrome cache.
  - seized 5y ago
    The reason may be so that services on private subnets don't need internet access to use Let's Encrypt. Just a guess though.
    - jclulow 5y ago
      You don't need direct Internet access to use Let's Encrypt, as long as you can arrange for the challenge response to appear in public DNS under the name you want to use.
      - jyrkesh 5y ago
        Would you mind giving an example of what that might look like? Or linking to something? I've always struggled with needing to open ports temporarily on stuff behind my own reverse proxy to avoid passing the certs by hand, and it sounds like something that'd be useful to understand.
        mcpherrinm 5y ago
        The magic phrase is “DNS-01” challenge. You place a DNS TXT record to validate control of the domain. There are lots of ACME clients that support a wide variety of DNS service providers. For example, I have a Home Assistant server which automatically issues certs using Gandi DNS and the HA Lets Encrypt support, all without being on the internet (except for the DNS entries)
        tetha 5y ago
        It's the DNS-01 challenge[1]. This reduces the challenge to using some DNS provider with an API supported by a client[2] / [3], as well as the server needing to be able to reach the LE-API. We use this with the CNAME delegation into an irrelevant zone everywhere to get wildcard certificates for our LBs ( meaning: the _acme_challenge.example.com record is just a CNAME for _acme_challenge.dont.ever.use.this.example.com, and the servers just have credentials to modify records in the zone <dont.ever.use.this.example.com>) 1: https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... 2: https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins https://eff-certbot.readthedocs.io/en/stable/using.html#dns-... 3: https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi
      - spockz 5y ago
        The acme client needs to reach LE though. Or you need to do a dance where the client is outside of the private network and ships the certificate into the private network.
  - fomine3 5y ago
    LE has compatibility issue with very old Android/OpenSSL. https://community.letsencrypt.org/t/production-chain-changes/150739 https://community.letsencrypt.org/t/production-chain-changes... Possibly Google's cert doesn't have the issue?
    - kijin 5y ago
      Yeah, that transition didn't go as smoothly as they might have hoped. Most of us first-world programmers can just shrug and say "don't use unsupported versions," but I've had multiple non-technical clients call me up urgently and ask why a (relatively small, but not insignificant depending on the market, and definitely not in their control) subset of their users were seeing certificate errors. So I don't recommend LE to my clients anymore. But it's a hassle to buy certificates the old way after having tasted ACME, so I'm always looking for an ACME-compatible alternative. ZeroSSL is backed by a more conservative Sectigo CA, but its ACME endpoints aren't very reliable. If this Google cert becomes widely available, I might just as well switch to it. :)
      - pronoiac 5y ago
        From memory, ZeroSSL also gets expensive after a couple of domains, and I had issues using certbot rather than acme.sh with it.
        kijin 5y ago
        Nowadays you can get virtually unlimited 90-day certs from ZeroSSL if you use ACME through the EAB feature rather than using their API. But their ACME support seems half-hearted at best. The endpoints often return errors for no reason, compatibility with clients is hit-and-miss, and they keep spamming you with renewal notices even if you renew the cert. For important domains these days I just get a cheap 1-year DV cert like the good ol' days.
  - jfoster 5y ago
    Funny you should mention about the forums. There's been a fairly notable Chrome issue intermittently affecting users on MacOS X since late last year and Google seem oblivious to it. https://support.google.com/chrome/thread/135844398/chrome-isn-t-allowing-me-to-attach-files?hl=en https://support.google.com/chrome/thread/135844398/chrome-is... So, yeah... I don't want to depend on a free Google Cloud account for SSL.
- ricktdotorg 5y ago
  i am pretty certain (but happy to be corrected) that Google has never killed a GCP service that paying customers are using. Google != Google Cloud Platform
- rapnie 5y ago
  > Which does raise an issue: I'm not sure why you'd use this, given Google's .. the biggest advertising giant on the planet that sucks up as much data as they possibly can about their subjects. > What's the compelling reason to switch
- Thorrez 5y ago
  >up till, I guess now, Google Cloud TLS is just LetsEncrypt. Google Cloud has been issuing certs for customer use off its own CA ( pki.goog ) for a while. It went GA April 27, 2020: https://cloud.google.com/load-balancing/docs/release-notes#April_27_2020 https://cloud.google.com/load-balancing/docs/release-notes#A... You can see the documentation here: https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs https://cloud.google.com/load-balancing/docs/ssl-certificate... GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Or you can restrict the load balancer to just get certs one of them by using a DNS CAA record. Up till now, you could only use pki.goog with GCP load balancers. This new release allows pki.goog to be used with anything, because you actually control the private key. Disclosure: I work in Google Cloud.
  - francislavoie 5y ago
    > GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Awesome, glad to see other ACME clients using issuer fallback, like Caddy does! Do you know if there are any plans to making the Google ACME CA usable without registration? Having to register for an account and using credentials is a huge barrier to entry for many less-technical users. Caddy is able to use LE and ZeroSSL because they both don't _require_ accounts (ZeroSSL recommends it, partially as an upsell, but it's not necessary). The more no-registration CAs exist, the more resilient ACME clients can be.
    - Thorrez 5y ago
      Sorry, I don't know the plans. I don't work on that team.
  - XorNot 5y ago
    Mid-year 2020 is not what I'd call running a service for "a while". That means its been GA just long enough to drop out of college.
    - Thorrez 5y ago
      You could drop out after one day. If you drop out fast enough you might qualify for a refund. I heard of someone who enrolls in a community college every winter, then goes skiing on a student discount, then drops out quickly and gets a refund. Not very ethical... Sorry, this was completely unrelated to your point.
- blackoil 5y ago
  If you are worried about `Google's history of killing projects`, you will anyway not be on Google Cloud.
lights0123 5y ago
> only for Google Cloud customers for which there's no payment required as far as I can tell—just creating a Google Cloud account.
- mcpherrinm 5y ago
  I think you do have to have a payment card on file, even if there’s no payments to be made.
  - onion2k 5y ago
    ... which is how they connect your account to who you are (or who you work for), so they can extract value from your social graph instead. As the adage goes, if it's free you are the product, not the customer.
    - derefr 5y ago
      GCP, AWS, other IaaS providers, and more generally, any "post-paid" service company, needs your credit card, because the services these providers provide allow users to generate costs that can only be measured after-the-fact; and where those costs greatly exceed the free-plan limits, the provider wants to be able to pass those costs to the user. As well, post-paid providers rely on credit-card billing information to deduplicate/KYC users. Without this sort of information, an, er, "ingenious" user could just sign up for a million free-tier accounts and lash them together into a quota-evading resource-sucking behemoth.
      - onion2k 5y ago
        Sure. All that is true. And the credit card number ties your free GCE account to your profile with credit agencies that ad companies use to improve their targeting. It's not one thing or the other. It's both.
        derefr 5y ago
        Do you think it's really that valuable for Google to spend engineering hours on an ad-targeting integration that will only improve targeting for maybe ~100k users at most? And probably far less, actually. As many GCP users as there might be in the world, most of them are IT staff working for some-or-another enterprise; where that enterprise only has a single GCP billing-account administrator. Nobody else in the enterprise has their card on file. (And that billing-account administrator's card-on-file is just a corporate credit card, that tells you what the corporation buys, but tells you nothing about the individual. And their email is just a group/alias — billing@ or somesuch. Impossible to log into; impossible to browse the web as; no way to target ads at.) You'd think the long tail of individual accounts could have more value, but those are the same users who GCP is least interested in recruiting to their platform, and the ones whose entered data is least trustworthy, because of all the spammers and crypto-miners attempting to use stolen credit cards to pay for service. You want to bind some poor random Joe's card-hubbed ad-profile to a spoke created by the person who stole their identity? That's negative average ad-targeting ROI!
aaomidi 5y ago
It uses google cloud binding, but you can request and use these certificates from any system.
notatoad 5y ago
>I would have expected some sort of acknowledgement to their fantastic work over the years. i think their platinum-level sponsorship of the ISRG is probably more meaningful than a shout-out in a blog post.
- binwiederhier 5y ago
  That's actually a really good point. Though sometimes words are of acknowledgement are equally important. Likely not here though. I'm sure they'd rather take the money ;-) Side note: I'm actually so proud that my company, Datto, has also been sponsoring Let's Encrypt for many years, and that I was the one to suggest it. It's not platinum, but it's still $50k per year.
  - lnxg33k1 5y ago
    Can you guys send an email to Atlassian?
  - cpach 5y ago
    That’s not peanuts indeed. Well done, Datto!
  - Narkov 5y ago
    Well done Datto! Thanks for supporting the Internet.
  - notatoad 5y ago
    yeah, words of encouragement can be great, but i don't think anybody at LetsEncrypt is in any doubt that Google is happy with the work they are doing. also, i get the sense that getting wider adoption for FIDO outside of LetsEncrypt is a bit of a goal, so having a third-party announce support for FIDO without referring to it as "the LetsEncrypt protocol" is kind of a win for the FIDO people.
- deleted 5y ago
  [deleted]
- ljm 5y ago
yjftsjthsd-h 5y ago
Oh, so they've achieved parity with AWS. That's still nice, if not particularly impressive.
- INTPenis 5y ago
  Well sort of. Using ACME means you're not locked into AWS API.
  - deleted 5y ago
    [deleted]
- rmhrisk 5y ago
  No, GCP has had arguably a superior TLS story for years. For example they do managed TLS for their workloads like AWS but they operate their own CA rather than outsourcing to Digicert for certificate issuance which gives them a better SLA. They have a global load balancer offering that enables TLS to terminate everywhere GCP is without having to manage a bunch of discrete load balancers, this also supports managed TLS. They now support a very large number of certificates in the global load balancer product which allows SaaS products like hosting services to leverage the global load balancer rather than deploying a load balancer per 25 certificates (the limit per AWS LB). And now let you enroll for certificates from the same CA they use even if you terminate TLS rather than having them do it for you. They do this via a standard API (ACME) which lets you have uniform and agile device compatibility regardless of how you deploy TLS. AWS doesn't let you do this at all. (I should note I was the PM for most of these releases and am still the PM for Google Trust Services the CA used for this ACME release)
winternett 5y ago
And that they're using chrome browser to make certs a mandatory and increasingly expensive monthly subscription service for site owners even though for many sites that don't handle secure transactions it really shouldn't be a requirement. In 2026 only rich companies will be able to maintain sites with the way we're going folks.
- charcircuit 5y ago
  Certs are free. What do you mean monthly subscription? Also why would secure transactions be necessary? Preventing third parties from injecting ads / mining scripts / phishing logins benefits all sites.
- mosen 5y ago
  LetsEncrypt is free.
- otterley 5y ago
  SSL certificates are cheaper than most DNS domain renewals are. ssls.com has them for as low as $3.88 per year; and you can use Let’s Encrypt for free.
noway421 5y ago
Quite odd indeed, maybe there are some legal reasons not to mention it. If they could, I feel the whole article could be condensed to "we just shipped a LetsEncrypt alternative gated to Google Cloud customers".
snickmy 5y ago
On this note, I wonder if there is any way to get a google cloud account, and use it JUST for this, without any $$. I don't think so, right? because best option you still need some sort of reverse proxy to your own server?!
- Ayesh 5y ago
  As far as I can tell (I now have the API access, so I might test later), you only need to provide additional authentication credentials to Certbot. The private key stays on your server. The CA server _might_ reject requests that do not come from GCP, or attempt to obtain one for a domain name not setup with GCP.
  - rmhrisk 5y ago
    There is no origin limitation. It works on premise or cross cloud.
tialaramex 5y ago
It probably doesn't mention Let's Encrypt because that's an extra opportunity for confusion since you do not (usually?) get Let's Encrypt certificates from this service. This service has nothing to do with Let's Encrypt, you get certificates from GTS, so the connection would be that ISRG / Let's Encrypt was part of the work to develop ACME and so on. But that's increasingly ancient history. The goal of the work was that almost all CAs in the Web PKI would offer ACME (the people doing like a dozen issuances per month maybe not, but there's an open question about whether they should even exist) -- not just this one free service operated by a charity and here Google are following through. I'd say that it's the same as if Zig announces each new compiler version or whatever and doesn't acknowledge that, yeah, Grace Hopper is in some sense responsible for the idea of compilers. [[ Hopper wrote the first "compiler" although today we would not consider her software to be a "compiler" but maybe a loader/linker. Anyway, the whole practice of having the machine do the boring job of writing machine code while a human just expresses what they wanted is down to Grace. Thinkers like Turing would have known this was possible in theory but Grace wasn't writing theory, she was doing engineering. ]]. Grace Hopper is important and worth celebrating, but it would be weird to insist on making a specific programming language that has nothing to do with Grace mention her every release. I guess if you're an Oscar's speech writer going for that "I want to thank my parents, without whom I wouldn't be here today" vibe, then yeah. But otherwise it seems unnecessary.
mikomikarro 5y ago
Nice!

_yoqn 5y ago

Who would trust Google with their infrastructure these days anyway? Personally I do need to work with Google services occasionally but always experience default anxiety about it.

antonvs 5y ago
We run our company on Google Cloud, spending about $400k a year on it. I previously worked heavily with AWS. From a technical perspective Gcloud is pretty great. People's saltiness about the consumer/advertising side of Google having killed their favorite free product is pretty irrelevant in this context.
- nicce 5y ago
  I wouldn’t say irrelevant as this is free service as well and same people are making decisions in upper management. There is always a catch and they don’t make anything if it is not bringing more revenue.
  - antonvs 5y ago
    This is a free feature on GCP. Many features on GCP are free because they're bundled into the pricing. > same people are making decisions in upper management. That's not true. Google Cloud has its own CEO and a very different business model. > they don’t make anything if it is not bringing more revenue. Sure - they're a for-profit business. Google Cloud's revenue was $13bn in 2020, and as of last quarter it had a run rate of $22 bn. That money comes direct from paying customers. The business model of the consumer/ad side really is irrelevant here.
    - nicce 5y ago
      > That's not true. Google Cloud has its own CEO and a very different business model. Business model is different indeed, but the parent company is still Alphabet, which in the end has huge influence.
      - 5y ago

vmception 5y ago

Double dare you to use and rely on that

deleted 5y ago
[deleted]

paxys 5y ago

*For Google Cloud customers. Not exactly "free" when you are required to pay into the ecosystem.

garaetjjte 5y ago
I don't think you need to pay anything for Google Cloud account, no?
- jvolkman 5y ago
  That's right. I've had a tiny vm running for years and have never paid anything.
  - ipaddr 5y ago
    But they hold your credit card and you gave them permission to bill you if you get more traffic
    - jvolkman 5y ago
      There are ways to automatically kill billing (and thus service) on a project in response to cost overruns.
      - teleforce 5y ago
        Please share the ways, thanks.
        jvolkman 5y ago
        I was thinking of this example: https://cloud.google.com/billing/docs/how-to/notify#cap_disable_billing_to_stop_usage https://cloud.google.com/billing/docs/how-to/notify#cap_disa...
        tialaramex 5y ago

acutesoftware 5y ago

That's great, and I am sure it is cool, but I don't trust Google to keep products maintained any more. I won't be trying it out.

deleted 5y ago
[deleted]

steveneo 5y ago

When google announces a new product, the first thing I think about is always when that product will be shut down.

threatofrain 5y ago
Does Google have a reputation of shuttering their paid products?
- jfim 5y ago
  On the consumer side of things, they have. Nest guard has been discontinued, and Google play music has been replaced by YouTube music, which lacks some of the features of its predecessor.
- ipaddr 5y ago
  This is a free product. They have a reputation for shutting down anything and everything including some paid products.
  - antonvs 5y ago
    It's a free feature on GCP. Lots of things on GCP are free, because they're bundled into the overall pricing.
- adrr 5y ago
  We were on Google Hire when they shut it down.
- bruce511 5y ago
  Google maps api got a 7000% price increase. So, not shuttered but....
ttty 5y ago
Not only that, if they charge and you dispute any payments they might ban your account. (This service requires a credit card )
deleted 5y ago

_nickwhite 5y ago

Sorry, you’re too late. Already discontinued. Obviously kidding! Glad to see this brought online for GCP customers.

deleted 5y ago
[deleted]

bruce511 5y ago

The article has been on HN for an hour. It has 8 comments, 5 of which were my first thought - why on earth would you expect this service to hang around, based on Google's track record? Wether it lasts or not, this surely has to be an issue for Google innovations going forward? If the perception is that any new thing will die, especially not-consumer-scale things, then how do they build traction?

refulgentis 5y ago
The people who believe this are going to keep believing it, there's not really anything to dissuade them. A priori anything might be cancelled could be and is worthless. Most don't have that extreme of a position, Reader and Allo were the last big deprecations.
- inlined 5y ago
  I can’t think of a single google cloud product that’s gone GA and then been shut down. Google has different attitudes towards consumer and enterprise products.
  - pxeboot 5y ago
    Google Cloud Print was shutdown [1]. [1] https://www.google.com/cloudprint/learn/ https://www.google.com/cloudprint/learn/
    - jvolkman 5y ago
      Despite the name I don't think that was actually part of GCP.
    - seized 5y ago
      I was salty about that too, but it wasn't a Google Cloud Platform (GCP) product. It just had cloud in its name.
    - jrockway 5y ago
      That's just poor branding. Google Cloud Print was not part of Google Cloud Platform. (I feel like Google just doesn't understand branding. I remember when they launched the Pixel C after the Chromebook Pixel, and it ran Android instead of ChromeOS. What was once a Chrome brand became an Android brand. I guess because Chrome was doing pretty well at the time, and Android just reminded people of slow phones that ran out of battery instantly. Sigh!)

deleted 5y ago

[deleted]

alfiedotwtf 5y ago

I found this article via Google Reader

deleted 5y ago
[deleted]

Jac1 5y ago

inlined 5y ago
Is thiS supposed to be some Loony Tunes joke? ACME is the name of the protocol.
- schoen 5y ago
  The Let's Encrypt community also made some fun references to the Roadrunner cartoons in the early days. (1) The reference implementation of the ACME server was originally going to be called Anvil, but was renamed to Boulder. (A later lightweight testing implementation is called Pebble.) (2) A later ACME client was called "dehydrated", after, well, take a look: https://github.com/dehydrated-io/dehydrated https://github.com/dehydrated-io/dehydrated (3) I'm pretty sure I'm forgetting another roadrunner joke here somewhere
  - Jac1 5y ago
    And given the tendency towards self owns in the certificate side of administration, a little bit of self awareness in the naming is called for. Pop culture has a way of distorting mental connections, and marketing should be aware of that.

woleium 5y ago

Surely this is just google derisking an external dependency (letsencrypt), so they have full vertical integration, no?

foepys 5y ago
At least cloudflare and AWS have been doing this for a very long time. Only they weren't using ACME but their own proprietary APIs where you couldn't export the private keys to you own server. Considering Google requires you to have a GCP account, I don't think it's actually very different and they only wanted to save costs by not developing more customer tooling.

robertwt7 5y ago

so it's only free for GCP customers..

upsidesinclude 5y ago

"FREE"

deleted 5y ago
[deleted]

yonran 5y ago

How do these certificates compare against letsencrypt on the technical dimensions? e.g. certificate chain size, rate limits, whether every certificate is published to the certificate transparency logs, what OSs the root CAs are compatible with?

kyrra 5y ago
Googler, opinions are my own. I know nothing about this project, but I've had to deal with Google certs a few times. It sounds like the roots are the ones that Google uses to sign it's own domains (like Google.com), which are these: https://pki.goog/repository/ https://pki.goog/repository/ So likely support for them is fairly broad.
- tannhaeuser 5y ago
  Isn't it odd that Google would sign their own domains? After all, https is about ensuring your sites's authenticity to your visitor via a trusted third-party certificate. This sounds like it's mostly there to make it difficult to modify content by intermittent parties, such as ads and tracking added by your ISP. As such, "self-signing" by your own root CA would appear as a conflict of interest, and only add to SSL enforcement increasingly seen as gatekeeping.
  - perlgeek 5y ago
    It doesn't really matter which CA signs a certificate, as long as that CA is in the trust root of all major browsers and other clients. Which is the case for google's CA.
  - zinekeller 5y ago
    > After all, https is about ensuring your sites's authenticity to your visitor via a trusted third-party certificate. No longer especially that pre-LE, those same third-party sites already broke the rules, even with their EV offerings. Everything has been reduced to "is this domain at least controlled by them?" which is easily auditable (organisational verification has been significantly devalued). Now, Let's Encrypt only verifies domains and not trustworthiness (in fact, they won't revoke certificates known as phishing sites). Also EV certificates are nearly worthless unless you want to bypass many antivirus' HTTPS interception.

Zhenya 5y ago

Is this free like custom domain for gmail free? yeesh

BLKNSLVR 5y ago
I'm as salty as the next person about the ending of the free custom-domain gmail service, but it did last for over 10 years, which is plenty of time to get double ROI for the time and setup investment of the free google solution, and then the replacement solution if / when google rug-pulls the "free" component. The equation does change if there are value-adds that start getting offered and used which make it more difficult to transition elsewhere (with docs, gdrive etc. being examples of value-adds for the free custom-domain email offering).
deleted 5y ago
[deleted]

jiggawatts 5y ago

The big benefit of ACME is that it verifies domain ownership at the correct level. DigiCert and the like will typically require domain verification at the TLD+1, which is meaningless gibberish that isn't even remotely an RFC standard. There's no such "concept" in DNS, which is intended to be delegated. So for example if I'm tasked with deploying a web app to "dev1.app.project.org.parentcompany.megacorp.co.uk" where the "project team" is based out of -- say -- Australia, then DigiCert will insist that I verify that I own "megacorp.co.uk", which... I don't. The parent company might not either. MegaCorp's UK head office does. They've never heard of me, and it'll take me a month to get through to someone who cares about my tiny, outsourced project down under. This kind of thing has happened to me repeatedly across both corporate and government projects. A 2-week project can have a 1 month delay added to it because of this. ACME gets it right, and nobody else does.

justin_oaks 5y ago
I encountered the same problem with DigiCert. I was trying to verify ownership OF A SUBDOMAIN (e.g. sub.example.com) and I was given a TXT record to add to my DNS. I added it to the subdomain sub.example.com but the verification kept failing. It wasn't until I added it to my domain (example.com) that the verification succeeded. Who thought that was a good idea? It was especially frustrating since I had verified ownership of the domain minutes before. Why do I have to do it again for every subdomain?
derefr 5y ago
My understanding with how TLS was originally intended to be modelled, is that Certificate Authority-ness was supposed to be delegated as well; or at least, more and smaller entities were supposed to be CAs. (About the same kinds of entities who got IPv4 /8 allocations, really.) Big companies like Microsoft were definitely supposed to be their own CAs, enabling them to assert the authenticity of their own zones' subdomains' certificates without the help of any external CA. Generic commercial CAs were supposed to be for the use of regular contractors, not enterprise megacorps. For some reason (probably industry collusion), X.509 Name Constraints were there from the beginning to enable an extensible generalization of this, but we really missed the boat on supporting them, until eventually doing so became very very hard. We're still making progress toward enablement, though!

PaywallBuster 5y ago

Where can I see the rate limits?

ck2 5y ago

Would that be like the "free for life" google gsuite accounts that are ending next month? Do not rely on any "free" google product you aren't willing to pay for.

lanbanger 5y ago

April 2023: Google announces end of free ACME server

deleted 5y ago
[deleted]

jesprenj 5y ago

> Do you issue certificates for punycode encoded Unicode domain names? > Not at this time. I thought punycode solved all integration issues and is meant to be backwards compatible ...

deleted 5y ago
[deleted]
pilif 5y ago
It is backwards compatible, so this tells me that they added an additional check to prevent certificates for such domains to be issued. I think this is a security measure that prevents people from getting certificates for homoglpyh domains. Browsers already offer some protection, but why not add an additional layer?
- vbezhenar 5y ago
  This is not protection. People will get it from letsencrypt or any other CA.
  - pilif 5y ago
    yes, but google will be spared the bad press when this issue goes through the press again as it seems to happen every few years.
deleted 5y ago
[deleted]

sydbarrett74 5y ago

INTPenis 5y ago

We've had an internal ACME server at my dayjob for over a year now. It's one of the few things I'm proud of where we really got out early on a cool technology. Otherweise we're a big telco and move like a oil tanker.

midrus 5y ago

Wile E. Coyote will be so happy with this.

theptip 5y ago

This is great news. One limitation with Lets Encrypt is their rate limits are a bit low for Review Apps - you can’t issue more than 50 certs a week under a given domain. So if you’re spinning up tens or hundreds of review apps per day, you can’t get a fresh cert for each, and so you need to do something different than your production environment does. (A wildcard cert is the obvious choice.) I hope this offering has a high enough quota that you can get enough certs to do review apps properly; the marginal cost to Google per customer is probably negligible, whereas LetsEncrypt doesn’t have other revenue generating offerings they can use to cover their operating costs.

bruce343434 5y ago
I thought letsencrypt offered wildcard certs?
- theptip 5y ago
  Yes, they do. But if you use a wildcard cert for your review app, then you are not testing the same cert machinery as your production application. (Unless you want to use wildcard certs for your prod app too, which I'd rather not do.)
paulgb 5y ago
What’s a “review app” in this context? Are you talking about instances spun up to preview/review a pull request?
- theptip 5y ago
  Yep, Review Apps are spinning up a full copy of your application per PR. https://docs.gitlab.com/ee/ci/review_apps/ https://docs.gitlab.com/ee/ci/review_apps/ As part of my pre-merge pipeline I deploy the application to k8s, create a public IP, DNS entry from the branch slug, TLS-to-the-pod with wildcard cert, and then run the full end-to-end test suite. If you get your docker caching right, it can be as little as a couple minutes to deploy the whole stack This makes it a lot easier for engineers to iterate on their changes with stakeholders, not to mention it lets you test infra and API changes before actually merging them. We got to tens of engineers using this, so I didn't optimize utilization heavily; this ends up being a bit expensive, but I think worth it.

alpb 5y ago

One major problem with Google’s L7 load balancers is that the config changes take 5-20 mins to take effect. So google trying to set up an ACME challenge on a LB, solving it, and setting the managed TLS cert on it can take non-negligible time (15-30 mins?). I hope this gets fixed someday.

egberts1 5y ago
HTTP caching is probably and should be turned off when accessing a specific subdomain for ACME challenge (at Google reverse proxy level), I think. One should not have to do anything extra unless the requester too also run a load balancer in front of their subdomain in question. That’s why ACME challenge offers several different type of protocols (to get by the many caching servers.
rmhrisk 5y ago
With the recent GCP Cloud Certificate Manager release the global propagation time is minutes. (I should note I was a PM for this feature)

midjji 5y ago

"Free"

miked85 5y ago

It really would be a mistake to trust your business with a Google product in general, especially a "free" one.

deleted 5y ago
[deleted]

aaronchall 5y ago

I recall stories of Google arbitrarily declaring users persona non grata, ruining the user's business and even their life, with no recourse. Is this another such risk vector?

pilif 5y ago
> Is this another such risk vector? no because there are other CAs which offer support for the ACME protocol. That's the good thing about open standards.

elcomet 5y ago

Previous title was much better @dang

deleted 5y ago
[deleted]

egberts1 5y ago

Q: Do you offer certificates from a pure ECC based certificate chain? A: Not at this time. I see what you did there.

JoachimS 5y ago

Will it bring in advertising dough? If not, possibly reserve a spot here: https://killedbygoogle.com/ https://killedbygoogle.com/

deleted 5y ago
[deleted]

vbezhenar 5y ago

Another ACME alternative to letsencrypt is zerossl. It's especially great because letsencrypt is operated by US company ISRG and zerossl seems to be from Austria, so if you're not happy with your server being dependant on US, it might be a good option.

notsound 5y ago
Buypass also runs a free acme program. https://www.buypass.com/products/tls-ssl-certificates/go-ssl https://www.buypass.com/products/tls-ssl-certificates/go-ssl
cm2187 5y ago
Though migrating to a different CA on a short notice shouldn’t be too hard.

frankfrankfrank 5y ago

Speaking of which; is anyone else old enough to remember when it was discovered that all (Root) Certificate Authorities were compromised by the 5+1 eyes?

rwiggum 5y ago
Can you say more about this or point to a source? I'm very curious to learn more about this!

bogomipz 5y ago

From the FAQ: >"Each of these have different scenarios where their use makes the most sense, for example TLS-ALPN-01 might make sense in cases where HTTPS is not used and the requestor does not have access to dynamically update DNS records." I'm confused by TLS-ALPN-01. I understand the idea of using certs for domain verification but if there is no TLS in use how does the client verify this after the cert has been issued exactly?

zinekeller 5y ago
This is usually used by TLS terminators, which don't have an HTTP server available (can understand TLS but not HTTP). ALPN here is a property of TLS ClientHello which specifies the capabilities of the client, usually used to signal support for HTTP 2 but in this specific case signals that the TLS client is an ACME verier on behalf of a CA, so the TLS server only sends the validator certificate when the validators specifically requesting it (ensuring interruption-free validation). The important part here is that a TLS server is available but HTTPS is not available as it is either only a TLS terminator or something that operates a non-HTTPS TLS server (for example, RTMPS).
- bogomipz 5y ago
  >"The important part here is that a TLS server is available but HTTPS is not available as it is either only a TLS terminator or something that operates a non-HTTPS TLS server (for example, RTMPS)." That makes good sense. Thanks for putting it so succinctly. Cheers.

Tobu 5y ago

Any status for RFC 8657, ACME CAA support? This is for restricting which account and which validation methods may issue certificates. The CPS says they may use it, which is too vague and I'm not going to test it right now. https://www.rfc-editor.org/rfc/rfc8657.html https://www.rfc-editor.org/rfc/rfc8657.html https://pki.goog/repo/cps/4.7/GTS-CPS.pdf https://pki.goog/repo/cps/4.7/GTS-CPS.pdf

Tobu 5y ago
By the way, I appreciate the support for short-term certificates as well; Letsencrypt doesn't have it, though invalidation can be detected with OCSP or draft-aaron-acme-ari.