Hello from the App Engine team. Could you double check that your DNS records are accurate? Everything is looking good on our end. Thanks for the feedback!
We've found the glitch in the UI and the issue will be resolved shortly. Thanks for all the support and quick testing after announcing this beta release.
I was in the preview/alpha/whatever group. Never could get cert creation to work through the console UI, but it worked fine when using the gcloud SDK from the command-line.
It's basically invisible automation for creating and renewing LetEncrypt certs on App Engine.
The traditional process for installing a custom domain SSL cert on App Engine was very clunky. Involved running OpenSSL commands, cut-n-pasting PEM data, etc. If you were using LetsEncrypt, then it was more or less impossible to automate... you had to go through a tedious manual process every 3 months (including updating your app, to respond to the LetsEncrypt verification endpoint!).
A click on the browser padlock icon says that it's a LetEncrypt cert. Unsurprising, since Google is such a major sponsor. Also unsurprising that Google chooses to focus on their own branding rather than call attention to it.
It is _so_ nice not to (1) manage the certs with your own infrastructure (2) automatically deploy these things to HAProxy, Apache, MySQL, random server X.
Automated load balancing + cert management is heaven.
This is welcome news. This means I no longer have to track and manually renew my Let's Encrypt certificates for my websites.
I also see it as a way to incentivize folks to use GAE (not only are you getting free quotas to run your app, you also don't have to spend money to buy certificates and don't have to worry about installing or renewing them).
Finally, I also see it as another way of pushing for the uptake of SSL. With GAE doing this, other hosting services might also start offering something similar or close to it which would then beg the question - why is your site not using SSL.
The whole premise behind letsencrypt is the ACME protocol, so you don't have to manually renew certs [although you can]. The problem is in handling SSL renewals on a cluster, you have to do renewals via DNS & rsync certs around, and there's not many tools to do this. But for a single server, its very easy to automate. Another problem with letsencrypt is the rate limits & such.
Google App Engine only a few weeks ago released an API for managing certificates. Before that, the only way to add or update a certificate was to manually paste the key into a web form.
> Finally, I also see it as another way of pushing for the uptake of SSL. With GAE doing this, other hosting services might also start offering something similar or close to it which would then beg the question - why is your site not using SSL.
Good question. Everybody should be on SSL. It isn't just hosting services that should offer something similar, but SaaSes too that provide SSL on custom domains for their customers. They usually don't get around to securing those custom domains due to the pain and inconvenience and maintenance.
There are platforms out there like Clearalias and Cloudfront that help with making that a breeze though, so I don't see why it would be an issue going forward.
Hopefully with Google and browsers punishing non-SSL sites more, there'll be more sites behind an SSL cert.
I love app engine but one of the biggest issues I've had with it is the fact that memcached and search are not available for anything but app engine standard - python (2.7).
Providing access to both via app engine flexible would be god sent!
Your issue is then with using App Engine, not with them giving you a certificate. There is no way to use App Engine without them getting the plaintext in the end.
They do offer it for webapps using Lets Encrypt, but nothing else afaik. But I look forward to it being added, it is definitely needed. Even setting up the Let's Encrypt to auto renew is a very tedious process.
Hello from Backplane. You can get this on Azure today using https://www.backplane.io with end-to-end encryption to your backends plus a huge chest of other routing and security features. It's free to start. I'm blake at backplane dot io
53 comments
[ 3.0 ms ] story [ 119 ms ] threadI believe all my DNS records look fine, and I have the domain ownership set correctly with GAE. Not sure what else I can change to get it working.
I checked the DNS records and the CNAME, A, AAAA records of all the domains match exactly what is shown on the admin console.
Thanks for the support! And thanks for all the good work on AppEngine!
And thanks to other commenters too!
The traditional process for installing a custom domain SSL cert on App Engine was very clunky. Involved running OpenSSL commands, cut-n-pasting PEM data, etc. If you were using LetsEncrypt, then it was more or less impossible to automate... you had to go through a tedious manual process every 3 months (including updating your app, to respond to the LetsEncrypt verification endpoint!).
Edit: I am wrong. They use letsencrypt.
https://resumefodder.com/
A click on the browser padlock icon says that it's a LetEncrypt cert. Unsurprising, since Google is such a major sponsor. Also unsurprising that Google chooses to focus on their own branding rather than call attention to it.
This is fully automatic SSL management for your own domains that point to Google App Engine, with certs managed by Google.
Previously you had to use your own certs and manually upload them through the UI (or via the beta API, which is also now in general availability).
edit: managed, not provided, the certs are actually Let's Encrypt
If you want to see the progress here's the relevant ticket[0] -- nice to see it finally closed!
Not privy to the final implementation details but my guess it's a based on Let's Encrypt as suggested by the originator of the ticket and others.
Edit: Yeah, probably not Let's Encrypt as others have stated.
[0] https://issuetracker.google.com/issues/35900034
https://security.googleblog.com/2017/01/the-foundation-of-mo...
It is _so_ nice not to (1) manage the certs with your own infrastructure (2) automatically deploy these things to HAProxy, Apache, MySQL, random server X.
Automated load balancing + cert management is heaven.
Automating all routing, API gateways, TLS termination and certificate management makes life so much easier.
I also see it as a way to incentivize folks to use GAE (not only are you getting free quotas to run your app, you also don't have to spend money to buy certificates and don't have to worry about installing or renewing them).
Finally, I also see it as another way of pushing for the uptake of SSL. With GAE doing this, other hosting services might also start offering something similar or close to it which would then beg the question - why is your site not using SSL.
Hope they add the same functionality for Google Cloud HTTPS Load Balancers soon as well.
Good question. Everybody should be on SSL. It isn't just hosting services that should offer something similar, but SaaSes too that provide SSL on custom domains for their customers. They usually don't get around to securing those custom domains due to the pain and inconvenience and maintenance.
There are platforms out there like Clearalias and Cloudfront that help with making that a breeze though, so I don't see why it would be an issue going forward.
Hopefully with Google and browsers punishing non-SSL sites more, there'll be more sites behind an SSL cert.
I love app engine but one of the biggest issues I've had with it is the fact that memcached and search are not available for anything but app engine standard - python (2.7).
Providing access to both via app engine flexible would be god sent!
Also I think there is an alpha for flex?