2 ms·

>up till, I guess now, Google Cloud TLS is just LetsEncrypt. Google Cloud has been issuing certs for customer use off its own CA ( pki.goog ) for a while. It w

>up till, I guess now, Google Cloud TLS is just LetsEncrypt. Google Cloud has been issuing certs for customer use off its own CA ( pki.goog ) for a while. It went GA April 27, 2020: https://cloud.google.com/load-balancing/docs/release-notes#April_27_2020 https://cloud.google.com/load-balancing/docs/release-notes#A... You can see the documentation here: https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs https://cloud.google.com/load-balancing/docs/ssl-certificate... GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Or you can restrict the load balancer to just get certs one of them by using a DNS CAA record. Up till now, you could only use pki.goog with GCP load balancers. This new release allows pki.goog to be used with anything, because you actually control the private key. Disclosure: I work in Google Cloud.

francislavoie 5y ago
> GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Awesome, glad to see other ACME clients using issuer fallback, like Caddy does! Do you know if there are any plans to making the Google ACME CA usable without registration? Having to register for an account and using credentials is a huge barrier to entry for many less-technical users. Caddy is able to use LE and ZeroSSL because they both don't _require_ accounts (ZeroSSL recommends it, partially as an upsell, but it's not necessary). The more no-registration CAs exist, the more resilient ACME clients can be.
- Thorrez 5y ago
  Sorry, I don't know the plans. I don't work on that team.
XorNot 5y ago
Mid-year 2020 is not what I'd call running a service for "a while". That means its been GA just long enough to drop out of college.
- Thorrez 5y ago
  You could drop out after one day. If you drop out fast enough you might qualify for a refund. I heard of someone who enrolls in a community college every winter, then goes skiing on a student discount, then drops out quickly and gets a refund. Not very ethical... Sorry, this was completely unrelated to your point.

francislavoie 5y ago

> GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Awesome, glad to see other ACME clients using issuer fallback, like Caddy does! Do you know if there are any plans to making the Google ACME CA usable without registration? Having to register for an account and using credentials is a huge barrier to entry for many less-technical users. Caddy is able to use LE and ZeroSSL because they both don't _require_ accounts (ZeroSSL recommends it, partially as an upsell, but it's not necessary). The more no-registration CAs exist, the more resilient ACME clients can be.

Thorrez 5y ago
Sorry, I don't know the plans. I don't work on that team.

XorNot 5y ago

Mid-year 2020 is not what I'd call running a service for "a while". That means its been GA just long enough to drop out of college.

Thorrez 5y ago
You could drop out after one day. If you drop out fast enough you might qualify for a refund. I heard of someone who enrolls in a community college every winter, then goes skiing on a student discount, then drops out quickly and gets a refund. Not very ethical... Sorry, this was completely unrelated to your point.