11 ms·

That's great. Though maybe the title should acknowledge that it's only for Google Cloud customers. It's also quite odd that the article doesn't mention Let's E

That's great. Though maybe the title should acknowledge that it's only for Google Cloud customers. It's also quite odd that the article doesn't mention Let's Encrypt or the ISRG at all. I would have expected some sort of acknowledgement to their fantastic work over the years.

XorNot 5y ago
Also because up till, I guess now, Google Cloud TLS is just LetsEncrypt. Which does raise an issue: I'm not sure why you'd use this, given Google's history of killing projects. What's the compelling reason to switch - especially since they feel content to release this under the `alpha` command set for the CLI tool.
- KennyBlanken 5y ago
  Don't forget the "going to the store for some milk" phase of google products where for a few years it doesn't get any feature additions or bugfixes. I don't understand why anyone would go for this given LE is mature, stable, trusted, and well-supported. Say one day it just stops issuing you new certs; now what? Call someone? Nope. Post in the forums? Not unless you want to get asked if you've cleared your Chrome cache.
  - seized 5y ago
    The reason may be so that services on private subnets don't need internet access to use Let's Encrypt. Just a guess though.
    - jclulow 5y ago
      You don't need direct Internet access to use Let's Encrypt, as long as you can arrange for the challenge response to appear in public DNS under the name you want to use.
      - jyrkesh 5y ago
        Would you mind giving an example of what that might look like? Or linking to something? I've always struggled with needing to open ports temporarily on stuff behind my own reverse proxy to avoid passing the certs by hand, and it sounds like something that'd be useful to understand.
        mcpherrinm 5y ago
        The magic phrase is “DNS-01” challenge. You place a DNS TXT record to validate control of the domain. There are lots of ACME clients that support a wide variety of DNS service providers. For example, I have a Home Assistant server which automatically issues certs using Gandi DNS and the HA Lets Encrypt support, all without being on the internet (except for the DNS entries)
        tetha 5y ago
        It's the DNS-01 challenge[1]. This reduces the challenge to using some DNS provider with an API supported by a client[2] / [3], as well as the server needing to be able to reach the LE-API. We use this with the CNAME delegation into an irrelevant zone everywhere to get wildcard certificates for our LBs ( meaning: the _acme_challenge.example.com record is just a CNAME for _acme_challenge.dont.ever.use.this.example.com, and the servers just have credentials to modify records in the zone <dont.ever.use.this.example.com>) 1: https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... 2: https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins https://eff-certbot.readthedocs.io/en/stable/using.html#dns-... 3: https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi
      - spockz 5y ago
        The acme client needs to reach LE though. Or you need to do a dance where the client is outside of the private network and ships the certificate into the private network.
      - elcomet 5y ago
        I think you're confusing internet access with reachable from the internet. If I remember correctly, you don't need your server to be reachable from the internet, but you still need to be able to contact your DNS provider and the LE server, so you need internet access
  - fomine3 5y ago
    LE has compatibility issue with very old Android/OpenSSL. https://community.letsencrypt.org/t/production-chain-changes/150739 https://community.letsencrypt.org/t/production-chain-changes... Possibly Google's cert doesn't have the issue?
    - kijin 5y ago
      Yeah, that transition didn't go as smoothly as they might have hoped. Most of us first-world programmers can just shrug and say "don't use unsupported versions," but I've had multiple non-technical clients call me up urgently and ask why a (relatively small, but not insignificant depending on the market, and definitely not in their control) subset of their users were seeing certificate errors. So I don't recommend LE to my clients anymore. But it's a hassle to buy certificates the old way after having tasted ACME, so I'm always looking for an ACME-compatible alternative. ZeroSSL is backed by a more conservative Sectigo CA, but its ACME endpoints aren't very reliable. If this Google cert becomes widely available, I might just as well switch to it. :)
      - pronoiac 5y ago
        From memory, ZeroSSL also gets expensive after a couple of domains, and I had issues using certbot rather than acme.sh with it.
        kijin 5y ago
        Nowadays you can get virtually unlimited 90-day certs from ZeroSSL if you use ACME through the EAB feature rather than using their API. But their ACME support seems half-hearted at best. The endpoints often return errors for no reason, compatibility with clients is hit-and-miss, and they keep spamming you with renewal notices even if you renew the cert. For important domains these days I just get a cheap 1-year DV cert like the good ol' days.
  - jfoster 5y ago
    Funny you should mention about the forums. There's been a fairly notable Chrome issue intermittently affecting users on MacOS X since late last year and Google seem oblivious to it. https://support.google.com/chrome/thread/135844398/chrome-isn-t-allowing-me-to-attach-files?hl=en https://support.google.com/chrome/thread/135844398/chrome-is... So, yeah... I don't want to depend on a free Google Cloud account for SSL.
- ricktdotorg 5y ago
  i am pretty certain (but happy to be corrected) that Google has never killed a GCP service that paying customers are using. Google != Google Cloud Platform
- rapnie 5y ago
  > Which does raise an issue: I'm not sure why you'd use this, given Google's .. the biggest advertising giant on the planet that sucks up as much data as they possibly can about their subjects. > What's the compelling reason to switch
- Thorrez 5y ago
  >up till, I guess now, Google Cloud TLS is just LetsEncrypt. Google Cloud has been issuing certs for customer use off its own CA ( pki.goog ) for a while. It went GA April 27, 2020: https://cloud.google.com/load-balancing/docs/release-notes#April_27_2020 https://cloud.google.com/load-balancing/docs/release-notes#A... You can see the documentation here: https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs https://cloud.google.com/load-balancing/docs/ssl-certificate... GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Or you can restrict the load balancer to just get certs one of them by using a DNS CAA record. Up till now, you could only use pki.goog with GCP load balancers. This new release allows pki.goog to be used with anything, because you actually control the private key. Disclosure: I work in Google Cloud.
  - francislavoie 5y ago
    > GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Awesome, glad to see other ACME clients using issuer fallback, like Caddy does! Do you know if there are any plans to making the Google ACME CA usable without registration? Having to register for an account and using credentials is a huge barrier to entry for many less-technical users. Caddy is able to use LE and ZeroSSL because they both don't _require_ accounts (ZeroSSL recommends it, partially as an upsell, but it's not necessary). The more no-registration CAs exist, the more resilient ACME clients can be.
    - Thorrez 5y ago
      Sorry, I don't know the plans. I don't work on that team.
  - XorNot 5y ago
    Mid-year 2020 is not what I'd call running a service for "a while". That means its been GA just long enough to drop out of college.
    - Thorrez 5y ago
      You could drop out after one day. If you drop out fast enough you might qualify for a refund. I heard of someone who enrolls in a community college every winter, then goes skiing on a student discount, then drops out quickly and gets a refund. Not very ethical... Sorry, this was completely unrelated to your point.
- blackoil 5y ago
  If you are worried about `Google's history of killing projects`, you will anyway not be on Google Cloud.
lights0123 5y ago
> only for Google Cloud customers for which there's no payment required as far as I can tell—just creating a Google Cloud account.
- mcpherrinm 5y ago
  I think you do have to have a payment card on file, even if there’s no payments to be made.
  - onion2k 5y ago
    ... which is how they connect your account to who you are (or who you work for), so they can extract value from your social graph instead. As the adage goes, if it's free you are the product, not the customer.
    - derefr 5y ago
      GCP, AWS, other IaaS providers, and more generally, any "post-paid" service company, needs your credit card, because the services these providers provide allow users to generate costs that can only be measured after-the-fact; and where those costs greatly exceed the free-plan limits, the provider wants to be able to pass those costs to the user. As well, post-paid providers rely on credit-card billing information to deduplicate/KYC users. Without this sort of information, an, er, "ingenious" user could just sign up for a million free-tier accounts and lash them together into a quota-evading resource-sucking behemoth.
      - onion2k 5y ago
        Sure. All that is true. And the credit card number ties your free GCE account to your profile with credit agencies that ad companies use to improve their targeting. It's not one thing or the other. It's both.
        derefr 5y ago
        Do you think it's really that valuable for Google to spend engineering hours on an ad-targeting integration that will only improve targeting for maybe ~100k users at most? And probably far less, actually. As many GCP users as there might be in the world, most of them are IT staff working for some-or-another enterprise; where that enterprise only has a single GCP billing-account administrator. Nobody else in the enterprise has their card on file. (And that billing-account administrator's card-on-file is just a corporate credit card, that tells you what the corporation buys, but tells you nothing about the individual. And their email is just a group/alias — billing@ or somesuch. Impossible to log into; impossible to browse the web as; no way to target ads at.) You'd think the long tail of individual accounts could have more value, but those are the same users who GCP is least interested in recruiting to their platform, and the ones whose entered data is least trustworthy, because of all the spammers and crypto-miners attempting to use stolen credit cards to pay for service. You want to bind some poor random Joe's card-hubbed ad-profile to a spoke created by the person who stole their identity? That's negative average ad-targeting ROI!
aaomidi 5y ago
It uses google cloud binding, but you can request and use these certificates from any system.
notatoad 5y ago
>I would have expected some sort of acknowledgement to their fantastic work over the years. i think their platinum-level sponsorship of the ISRG is probably more meaningful than a shout-out in a blog post.
- binwiederhier 5y ago
  That's actually a really good point. Though sometimes words are of acknowledgement are equally important. Likely not here though. I'm sure they'd rather take the money ;-) Side note: I'm actually so proud that my company, Datto, has also been sponsoring Let's Encrypt for many years, and that I was the one to suggest it. It's not platinum, but it's still $50k per year.
  - lnxg33k1 5y ago
    Can you guys send an email to Atlassian?
  - cpach 5y ago
    That’s not peanuts indeed. Well done, Datto!
  - Narkov 5y ago
    Well done Datto! Thanks for supporting the Internet.
  - notatoad 5y ago
    yeah, words of encouragement can be great, but i don't think anybody at LetsEncrypt is in any doubt that Google is happy with the work they are doing. also, i get the sense that getting wider adoption for FIDO outside of LetsEncrypt is a bit of a goal, so having a third-party announce support for FIDO without referring to it as "the LetsEncrypt protocol" is kind of a win for the FIDO people.
- deleted 5y ago
  [deleted]
- ljm 5y ago
yjftsjthsd-h 5y ago
Oh, so they've achieved parity with AWS. That's still nice, if not particularly impressive.
- INTPenis 5y ago
  Well sort of. Using ACME means you're not locked into AWS API.
  - deleted 5y ago
    [deleted]
- rmhrisk 5y ago
  No, GCP has had arguably a superior TLS story for years. For example they do managed TLS for their workloads like AWS but they operate their own CA rather than outsourcing to Digicert for certificate issuance which gives them a better SLA. They have a global load balancer offering that enables TLS to terminate everywhere GCP is without having to manage a bunch of discrete load balancers, this also supports managed TLS. They now support a very large number of certificates in the global load balancer product which allows SaaS products like hosting services to leverage the global load balancer rather than deploying a load balancer per 25 certificates (the limit per AWS LB). And now let you enroll for certificates from the same CA they use even if you terminate TLS rather than having them do it for you. They do this via a standard API (ACME) which lets you have uniform and agile device compatibility regardless of how you deploy TLS. AWS doesn't let you do this at all. (I should note I was the PM for most of these releases and am still the PM for Google Trust Services the CA used for this ACME release)
winternett 5y ago
And that they're using chrome browser to make certs a mandatory and increasingly expensive monthly subscription service for site owners even though for many sites that don't handle secure transactions it really shouldn't be a requirement. In 2026 only rich companies will be able to maintain sites with the way we're going folks.
- charcircuit 5y ago
  Certs are free. What do you mean monthly subscription? Also why would secure transactions be necessary? Preventing third parties from injecting ads / mining scripts / phishing logins benefits all sites.
- mosen 5y ago
  LetsEncrypt is free.
- otterley 5y ago
  SSL certificates are cheaper than most DNS domain renewals are. ssls.com has them for as low as $3.88 per year; and you can use Let’s Encrypt for free.
noway421 5y ago
Quite odd indeed, maybe there are some legal reasons not to mention it. If they could, I feel the whole article could be condensed to "we just shipped a LetsEncrypt alternative gated to Google Cloud customers".
snickmy 5y ago
On this note, I wonder if there is any way to get a google cloud account, and use it JUST for this, without any $$. I don't think so, right? because best option you still need some sort of reverse proxy to your own server?!
- Ayesh 5y ago
  As far as I can tell (I now have the API access, so I might test later), you only need to provide additional authentication credentials to Certbot. The private key stays on your server. The CA server _might_ reject requests that do not come from GCP, or attempt to obtain one for a domain name not setup with GCP.
  - rmhrisk 5y ago
    There is no origin limitation. It works on premise or cross cloud.
tialaramex 5y ago
It probably doesn't mention Let's Encrypt because that's an extra opportunity for confusion since you do not (usually?) get Let's Encrypt certificates from this service. This service has nothing to do with Let's Encrypt, you get certificates from GTS, so the connection would be that ISRG / Let's Encrypt was part of the work to develop ACME and so on. But that's increasingly ancient history. The goal of the work was that almost all CAs in the Web PKI would offer ACME (the people doing like a dozen issuances per month maybe not, but there's an open question about whether they should even exist) -- not just this one free service operated by a charity and here Google are following through. I'd say that it's the same as if Zig announces each new compiler version or whatever and doesn't acknowledge that, yeah, Grace Hopper is in some sense responsible for the idea of compilers. [[ Hopper wrote the first "compiler" although today we would not consider her software to be a "compiler" but maybe a loader/linker. Anyway, the whole practice of having the machine do the boring job of writing machine code while a human just expresses what they wanted is down to Grace. Thinkers like Turing would have known this was possible in theory but Grace wasn't writing theory, she was doing engineering. ]]. Grace Hopper is important and worth celebrating, but it would be weird to insist on making a specific programming language that has nothing to do with Grace mention her every release. I guess if you're an Oscar's speech writer going for that "I want to thank my parents, without whom I wouldn't be here today" vibe, then yeah. But otherwise it seems unnecessary.
mikomikarro 5y ago
Nice!

XorNot 5y ago

Also because up till, I guess now, Google Cloud TLS is just LetsEncrypt. Which does raise an issue: I'm not sure why you'd use this, given Google's history of killing projects. What's the compelling reason to switch - especially since they feel content to release this under the `alpha` command set for the CLI tool.

KennyBlanken 5y ago
Don't forget the "going to the store for some milk" phase of google products where for a few years it doesn't get any feature additions or bugfixes. I don't understand why anyone would go for this given LE is mature, stable, trusted, and well-supported. Say one day it just stops issuing you new certs; now what? Call someone? Nope. Post in the forums? Not unless you want to get asked if you've cleared your Chrome cache.
- seized 5y ago
  The reason may be so that services on private subnets don't need internet access to use Let's Encrypt. Just a guess though.
  - jclulow 5y ago
    You don't need direct Internet access to use Let's Encrypt, as long as you can arrange for the challenge response to appear in public DNS under the name you want to use.
    - jyrkesh 5y ago
      Would you mind giving an example of what that might look like? Or linking to something? I've always struggled with needing to open ports temporarily on stuff behind my own reverse proxy to avoid passing the certs by hand, and it sounds like something that'd be useful to understand.
      - mcpherrinm 5y ago
        The magic phrase is “DNS-01” challenge. You place a DNS TXT record to validate control of the domain. There are lots of ACME clients that support a wide variety of DNS service providers. For example, I have a Home Assistant server which automatically issues certs using Gandi DNS and the HA Lets Encrypt support, all without being on the internet (except for the DNS entries)
      - tetha 5y ago
        It's the DNS-01 challenge[1]. This reduces the challenge to using some DNS provider with an API supported by a client[2] / [3], as well as the server needing to be able to reach the LE-API. We use this with the CNAME delegation into an irrelevant zone everywhere to get wildcard certificates for our LBs ( meaning: the _acme_challenge.example.com record is just a CNAME for _acme_challenge.dont.ever.use.this.example.com, and the servers just have credentials to modify records in the zone <dont.ever.use.this.example.com>) 1: https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... 2: https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins https://eff-certbot.readthedocs.io/en/stable/using.html#dns-... 3: https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi
    - spockz 5y ago
      The acme client needs to reach LE though. Or you need to do a dance where the client is outside of the private network and ships the certificate into the private network.
    - elcomet 5y ago
      I think you're confusing internet access with reachable from the internet. If I remember correctly, you don't need your server to be reachable from the internet, but you still need to be able to contact your DNS provider and the LE server, so you need internet access
- fomine3 5y ago
  LE has compatibility issue with very old Android/OpenSSL. https://community.letsencrypt.org/t/production-chain-changes/150739 https://community.letsencrypt.org/t/production-chain-changes... Possibly Google's cert doesn't have the issue?
  - kijin 5y ago
    Yeah, that transition didn't go as smoothly as they might have hoped. Most of us first-world programmers can just shrug and say "don't use unsupported versions," but I've had multiple non-technical clients call me up urgently and ask why a (relatively small, but not insignificant depending on the market, and definitely not in their control) subset of their users were seeing certificate errors. So I don't recommend LE to my clients anymore. But it's a hassle to buy certificates the old way after having tasted ACME, so I'm always looking for an ACME-compatible alternative. ZeroSSL is backed by a more conservative Sectigo CA, but its ACME endpoints aren't very reliable. If this Google cert becomes widely available, I might just as well switch to it. :)
    - pronoiac 5y ago
      From memory, ZeroSSL also gets expensive after a couple of domains, and I had issues using certbot rather than acme.sh with it.
      - kijin 5y ago
        Nowadays you can get virtually unlimited 90-day certs from ZeroSSL if you use ACME through the EAB feature rather than using their API. But their ACME support seems half-hearted at best. The endpoints often return errors for no reason, compatibility with clients is hit-and-miss, and they keep spamming you with renewal notices even if you renew the cert. For important domains these days I just get a cheap 1-year DV cert like the good ol' days.
- jfoster 5y ago
  Funny you should mention about the forums. There's been a fairly notable Chrome issue intermittently affecting users on MacOS X since late last year and Google seem oblivious to it. https://support.google.com/chrome/thread/135844398/chrome-isn-t-allowing-me-to-attach-files?hl=en https://support.google.com/chrome/thread/135844398/chrome-is... So, yeah... I don't want to depend on a free Google Cloud account for SSL.
ricktdotorg 5y ago
i am pretty certain (but happy to be corrected) that Google has never killed a GCP service that paying customers are using. Google != Google Cloud Platform
rapnie 5y ago
> Which does raise an issue: I'm not sure why you'd use this, given Google's .. the biggest advertising giant on the planet that sucks up as much data as they possibly can about their subjects. > What's the compelling reason to switch
Thorrez 5y ago
>up till, I guess now, Google Cloud TLS is just LetsEncrypt. Google Cloud has been issuing certs for customer use off its own CA ( pki.goog ) for a while. It went GA April 27, 2020: https://cloud.google.com/load-balancing/docs/release-notes#April_27_2020 https://cloud.google.com/load-balancing/docs/release-notes#A... You can see the documentation here: https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs https://cloud.google.com/load-balancing/docs/ssl-certificate... GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Or you can restrict the load balancer to just get certs one of them by using a DNS CAA record. Up till now, you could only use pki.goog with GCP load balancers. This new release allows pki.goog to be used with anything, because you actually control the private key. Disclosure: I work in Google Cloud.
- francislavoie 5y ago
  > GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Awesome, glad to see other ACME clients using issuer fallback, like Caddy does! Do you know if there are any plans to making the Google ACME CA usable without registration? Having to register for an account and using credentials is a huge barrier to entry for many less-technical users. Caddy is able to use LE and ZeroSSL because they both don't _require_ accounts (ZeroSSL recommends it, partially as an upsell, but it's not necessary). The more no-registration CAs exist, the more resilient ACME clients can be.
  - Thorrez 5y ago
    Sorry, I don't know the plans. I don't work on that team.
- XorNot 5y ago
  Mid-year 2020 is not what I'd call running a service for "a while". That means its been GA just long enough to drop out of college.
  - Thorrez 5y ago
    You could drop out after one day. If you drop out fast enough you might qualify for a refund. I heard of someone who enrolls in a community college every winter, then goes skiing on a student discount, then drops out quickly and gets a refund. Not very ethical... Sorry, this was completely unrelated to your point.
blackoil 5y ago
If you are worried about `Google's history of killing projects`, you will anyway not be on Google Cloud.

lights0123 5y ago

> only for Google Cloud customers for which there's no payment required as far as I can tell—just creating a Google Cloud account.

mcpherrinm 5y ago
I think you do have to have a payment card on file, even if there’s no payments to be made.
- onion2k 5y ago
  ... which is how they connect your account to who you are (or who you work for), so they can extract value from your social graph instead. As the adage goes, if it's free you are the product, not the customer.
  - derefr 5y ago
    GCP, AWS, other IaaS providers, and more generally, any "post-paid" service company, needs your credit card, because the services these providers provide allow users to generate costs that can only be measured after-the-fact; and where those costs greatly exceed the free-plan limits, the provider wants to be able to pass those costs to the user. As well, post-paid providers rely on credit-card billing information to deduplicate/KYC users. Without this sort of information, an, er, "ingenious" user could just sign up for a million free-tier accounts and lash them together into a quota-evading resource-sucking behemoth.
    - onion2k 5y ago
      Sure. All that is true. And the credit card number ties your free GCE account to your profile with credit agencies that ad companies use to improve their targeting. It's not one thing or the other. It's both.
      - derefr 5y ago
        Do you think it's really that valuable for Google to spend engineering hours on an ad-targeting integration that will only improve targeting for maybe ~100k users at most? And probably far less, actually. As many GCP users as there might be in the world, most of them are IT staff working for some-or-another enterprise; where that enterprise only has a single GCP billing-account administrator. Nobody else in the enterprise has their card on file. (And that billing-account administrator's card-on-file is just a corporate credit card, that tells you what the corporation buys, but tells you nothing about the individual. And their email is just a group/alias — billing@ or somesuch. Impossible to log into; impossible to browse the web as; no way to target ads at.) You'd think the long tail of individual accounts could have more value, but those are the same users who GCP is least interested in recruiting to their platform, and the ones whose entered data is least trustworthy, because of all the spammers and crypto-miners attempting to use stolen credit cards to pay for service. You want to bind some poor random Joe's card-hubbed ad-profile to a spoke created by the person who stole their identity? That's negative average ad-targeting ROI!

aaomidi 5y ago

It uses google cloud binding, but you can request and use these certificates from any system.

notatoad 5y ago

>I would have expected some sort of acknowledgement to their fantastic work over the years. i think their platinum-level sponsorship of the ISRG is probably more meaningful than a shout-out in a blog post.

binwiederhier 5y ago
That's actually a really good point. Though sometimes words are of acknowledgement are equally important. Likely not here though. I'm sure they'd rather take the money ;-) Side note: I'm actually so proud that my company, Datto, has also been sponsoring Let's Encrypt for many years, and that I was the one to suggest it. It's not platinum, but it's still $50k per year.
- lnxg33k1 5y ago
  Can you guys send an email to Atlassian?
- cpach 5y ago
  That’s not peanuts indeed. Well done, Datto!
- Narkov 5y ago
  Well done Datto! Thanks for supporting the Internet.
- notatoad 5y ago
  yeah, words of encouragement can be great, but i don't think anybody at LetsEncrypt is in any doubt that Google is happy with the work they are doing. also, i get the sense that getting wider adoption for FIDO outside of LetsEncrypt is a bit of a goal, so having a third-party announce support for FIDO without referring to it as "the LetsEncrypt protocol" is kind of a win for the FIDO people.
deleted 5y ago
[deleted]
ljm 5y ago

yjftsjthsd-h 5y ago

Oh, so they've achieved parity with AWS. That's still nice, if not particularly impressive.

INTPenis 5y ago
Well sort of. Using ACME means you're not locked into AWS API.
- deleted 5y ago
  [deleted]
rmhrisk 5y ago
No, GCP has had arguably a superior TLS story for years. For example they do managed TLS for their workloads like AWS but they operate their own CA rather than outsourcing to Digicert for certificate issuance which gives them a better SLA. They have a global load balancer offering that enables TLS to terminate everywhere GCP is without having to manage a bunch of discrete load balancers, this also supports managed TLS. They now support a very large number of certificates in the global load balancer product which allows SaaS products like hosting services to leverage the global load balancer rather than deploying a load balancer per 25 certificates (the limit per AWS LB). And now let you enroll for certificates from the same CA they use even if you terminate TLS rather than having them do it for you. They do this via a standard API (ACME) which lets you have uniform and agile device compatibility regardless of how you deploy TLS. AWS doesn't let you do this at all. (I should note I was the PM for most of these releases and am still the PM for Google Trust Services the CA used for this ACME release)

winternett 5y ago

And that they're using chrome browser to make certs a mandatory and increasingly expensive monthly subscription service for site owners even though for many sites that don't handle secure transactions it really shouldn't be a requirement. In 2026 only rich companies will be able to maintain sites with the way we're going folks.

charcircuit 5y ago
Certs are free. What do you mean monthly subscription? Also why would secure transactions be necessary? Preventing third parties from injecting ads / mining scripts / phishing logins benefits all sites.
mosen 5y ago
LetsEncrypt is free.
otterley 5y ago
SSL certificates are cheaper than most DNS domain renewals are. ssls.com has them for as low as $3.88 per year; and you can use Let’s Encrypt for free.

noway421 5y ago

Quite odd indeed, maybe there are some legal reasons not to mention it. If they could, I feel the whole article could be condensed to "we just shipped a LetsEncrypt alternative gated to Google Cloud customers".

snickmy 5y ago

On this note, I wonder if there is any way to get a google cloud account, and use it JUST for this, without any $$. I don't think so, right? because best option you still need some sort of reverse proxy to your own server?!

Ayesh 5y ago
As far as I can tell (I now have the API access, so I might test later), you only need to provide additional authentication credentials to Certbot. The private key stays on your server. The CA server _might_ reject requests that do not come from GCP, or attempt to obtain one for a domain name not setup with GCP.
- rmhrisk 5y ago
  There is no origin limitation. It works on premise or cross cloud.

tialaramex 5y ago

It probably doesn't mention Let's Encrypt because that's an extra opportunity for confusion since you do not (usually?) get Let's Encrypt certificates from this service. This service has nothing to do with Let's Encrypt, you get certificates from GTS, so the connection would be that ISRG / Let's Encrypt was part of the work to develop ACME and so on. But that's increasingly ancient history. The goal of the work was that almost all CAs in the Web PKI would offer ACME (the people doing like a dozen issuances per month maybe not, but there's an open question about whether they should even exist) -- not just this one free service operated by a charity and here Google are following through. I'd say that it's the same as if Zig announces each new compiler version or whatever and doesn't acknowledge that, yeah, Grace Hopper is in some sense responsible for the idea of compilers. [[ Hopper wrote the first "compiler" although today we would not consider her software to be a "compiler" but maybe a loader/linker. Anyway, the whole practice of having the machine do the boring job of writing machine code while a human just expresses what they wanted is down to Grace. Thinkers like Turing would have known this was possible in theory but Grace wasn't writing theory, she was doing engineering. ]]. Grace Hopper is important and worth celebrating, but it would be weird to insist on making a specific programming language that has nothing to do with Grace mention her every release. I guess if you're an Oscar's speech writer going for that "I want to thank my parents, without whom I wouldn't be here today" vibe, then yeah. But otherwise it seems unnecessary.

mikomikarro 5y ago

Nice!