Managed SSL for Google App Engine (opens in new tab)

Agreed this is super-exciting.

Hope they add the same functionality for Google Cloud HTTPS Load Balancers soon as well.

AWS has been offering free SSL certs for a year now, happy to see Google following their lead.

> Finally, I also see it as another way of pushing for the uptake of SSL. With GAE doing this, other hosting services might also start offering something similar or close to it which would then beg the question - why is your site not using SSL.

Good question. Everybody should be on SSL. It isn't just hosting services that should offer something similar, but SaaSes too that provide SSL on custom domains for their customers. They usually don't get around to securing those custom domains due to the pain and inconvenience and maintenance.

There are platforms out there like Clearalias and Cloudfront that help with making that a breeze though, so I don't see why it would be an issue going forward.

Hopefully with Google and browsers punishing non-SSL sites more, there'll be more sites behind an SSL cert.

The whole premise behind letsencrypt is the ACME protocol, so you don't have to manually renew certs [although you can]. The problem is in handling SSL renewals on a cluster, you have to do renewals via DNS & rsync certs around, and there's not many tools to do this. But for a single server, its very easy to automate. Another problem with letsencrypt is the rate limits & such.

I'm using kubernetes with kube-lego, and my experience is exactly the same.

Automating all routing, API gateways, TLS termination and certificate management makes life so much easier.

I was in the preview/alpha/whatever group. Never could get cert creation to work through the console UI, but it worked fine when using the gcloud SDK from the command-line.

Me too. If anyone figures this out, I'd love to hear more.

We use memcache but it’s really unreliable. I recommend rolling your own anyway.

Also I think there is an alpha for flex?

I guess it's based on Google's own Certificate Authority, instead of Let's Encrypt, according to this:

https://security.googleblog.com/2017/01/the-foundation-of-mo...

It is Let's Encrypt, I just converted my test project so that I could kill the Jenkins job to update the Cert.

  Issued By
    Common Name (CN)	Let's Encrypt Authority X3

I turned this on today via gcloud, and the certificate I was issued is from Let's Encrypt.

Google purchased its own root CA from GlobalSign, so I’d assume it’s coming from there instead.

They do offer it for webapps using Lets Encrypt, but nothing else afaik. But I look forward to it being added, it is definitely needed. Even setting up the Let's Encrypt to auto renew is a very tedious process.

Both environments are supported!

It's basically invisible automation for creating and renewing LetEncrypt certs on App Engine.

The traditional process for installing a custom domain SSL cert on App Engine was very clunky. Involved running OpenSSL commands, cut-n-pasting PEM data, etc. If you were using LetsEncrypt, then it was more or less impossible to automate... you had to go through a tedious manual process every 3 months (including updating your app, to respond to the LetsEncrypt verification endpoint!).

They did already have that.

This is fully automatic SSL management for your own domains that point to Google App Engine, with certs managed by Google.

Previously you had to use your own certs and manually upload them through the UI (or via the beta API, which is also now in general availability).

edit: managed, not provided, the certs are actually Let's Encrypt

If you are using App Engine, Google is terminating the TLS connection regardless...

Really?