Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Managed SSL for Google App Engine

cloudplatform.googleblog.com

Post reply on HN
Print view View original

11–20 of 54 posts

Re: Managed SSL for Google App Engine

#11

Post by AnssiH »

lklig wrote: post #7
thedevil wrote: post #3

Earlier quoted context omitted.

Me too. If anyone figures this out, I'd love to hear more.

Hello from the App Engine team. Could you double check that your DNS records are accurate? Everything is looking good on our end. Thanks for the feedback!

I can also reproduce the issue, i.e. "Failed to activate certificates." a few seconds after clicking "Enable managed security" with 4 domains checked.

I checked the DNS records and the CNAME, A, AAAA records of all the domains match exactly what is shown on the admin console.

Re: Managed SSL for Google App Engine

#12

Post by mbwalas »

AnssiH wrote: post #11
lklig wrote: post #7

Earlier quoted context omitted.

Hello from the App Engine team. Could you double check that your DNS records are accurate? Everything is looking good on our end. Thanks for the feedback!

I can also reproduce the issue, i.e. "Failed to activate certificates." a few seconds after clicking "Enable managed security" with 4 domains checked. I checked the DNS records and the CNAME, A, AAAA records of all the domains match exactly what is shown on the admin console.

Can you try using gcloud? There may be a UI problem.

Re: Managed SSL for Google App Engine

#13

Post by OzzyB »

This is a welcomed addition that many have been patiently waiting for.

If you want to see the progress here's the relevant ticket[0] -- nice to see it finally closed!

Not privy to the final implementation details but my guess it's a based on Let's Encrypt as suggested by the originator of the ticket and others.

Edit: Yeah, probably not Let's Encrypt as others have stated.

[0] https://issuetracker.google.com/issues/35900034

Re: Managed SSL for Google App Engine

#14

Post by iamgopal »

StevePerkins wrote: post #6
le-mark wrote: post #4

Is this basically just SNI for GAE? Or did they already have that?

It's basically invisible automation for creating and renewing LetEncrypt certs on App Engine. The traditional process for installing a custom domain SSL cert on App Engine was very clunky. Involved running OpenSSL commands, cut-n-pasting PEM data, etc. If you were using LetsEncrypt, then it was more or less impossible to automate... you had to go through a tedious manual process every 3 months (including updating you…

I think they do not use letsencrypt . They use thier own SSL, since they are now licencing authority.

Edit: I am wrong. They use letsencrypt.

Re: Managed SSL for Google App Engine

#15

Post by adeanzan »

AnssiH wrote: post #11
lklig wrote: post #7

Earlier quoted context omitted.

Hello from the App Engine team. Could you double check that your DNS records are accurate? Everything is looking good on our end. Thanks for the feedback!

I can also reproduce the issue, i.e. "Failed to activate certificates." a few seconds after clicking "Enable managed security" with 4 domains checked. I checked the DNS records and the CNAME, A, AAAA records of all the domains match exactly what is shown on the admin console.

I was able to reproduce the problem through the UI. I was able to get it working by using the gcloud CLI instead.

Re: Managed SSL for Google App Engine

#16

Post by paulddraper »

Been using AWS's certificate management.

It is _so_ nice not to (1) manage the certs with your own infrastructure (2) automatically deploy these things to HAProxy, Apache, MySQL, random server X.

Automated load balancing + cert management is heaven.

Re: Managed SSL for Google App Engine

#17

Post by StevePerkins »

iamgopal wrote: post #14
StevePerkins wrote: post #6

Earlier quoted context omitted.

It's basically invisible automation for creating and renewing LetEncrypt certs on App Engine. The traditional process for installing a custom domain SSL cert on App Engine was very clunky. Involved running OpenSSL commands, cut-n-pasting PEM data, etc. If you were using LetsEncrypt, then it was more or less impossible to automate... you had to go through a tedious manual process every 3 months (including updating you…

I think they do not use letsencrypt . They use thier own SSL, since they are now licencing authority. Edit: I am wrong. They use letsencrypt.

I am hosting this project on App Engine, and have been using their SSL management for a couple of months now:

https://resumefodder.com/

A click on the browser padlock icon says that it's a LetEncrypt cert. Unsurprising, since Google is such a major sponsor. Also unsurprising that Google chooses to focus on their own branding rather than call attention to it.

Re: Managed SSL for Google App Engine

#18

Post by iancarroll »

OzzyB wrote: post #13

This is a welcomed addition that many have been patiently waiting for. If you want to see the progress here's the relevant ticket[0] -- nice to see it finally closed! Not privy to the final implementation details but my guess it's a based on Let's Encrypt as suggested by the originator of the ticket and others. Edit: Yeah, probably not Let's Encrypt as others have stated. [0] https://issuetracker.google.com/issues/35…

Google purchased its own root CA from GlobalSign, so I’d assume it’s coming from there instead.

Re: Managed SSL for Google App Engine

#19

Post by ngrilly »

OzzyB wrote: post #13

This is a welcomed addition that many have been patiently waiting for. If you want to see the progress here's the relevant ticket[0] -- nice to see it finally closed! Not privy to the final implementation details but my guess it's a based on Let's Encrypt as suggested by the originator of the ticket and others. Edit: Yeah, probably not Let's Encrypt as others have stated. [0] https://issuetracker.google.com/issues/35…

I guess it's based on Google's own Certificate Authority, instead of Let's Encrypt, according to this:

https://security.googleblog.com/2017/01/the-foundation-of-mo...

Re: Managed SSL for Google App Engine

#20

Post by AnssiH »

mbwalas wrote: post #12
AnssiH wrote: post #11

Earlier quoted context omitted.

I can also reproduce the issue, i.e. "Failed to activate certificates." a few seconds after clicking "Enable managed security" with 4 domains checked. I checked the DNS records and the CNAME, A, AAAA records of all the domains match exactly what is shown on the admin console.

Can you try using gcloud? There may be a UI problem.

Thanks, it worked fine with the gcloud command.
Post reply on HN