How to use Let's Encypt with Google Cloud Platform | Hacker News Reader

How to use Let's Encypt with Google Cloud Platform

medium.com

55 pointstomasreimers32 comments

> Done! Your site is now HTTPS protected! Don’t forget to renew your cert in 3 months

This is not how Let's Encrypt is designed to work. Manually registering and then deploying a certificate and saying "don't forget to renew" does not make for a particularly high quality post.

It's hard to auto renew on GAE; in fact, I don't know how to config auto renew.

That's a big part of why this post is disappointing. It may as well be two separate posts titled "how to manually obtain an LE cert", and "how to manually install a cert on GAE".

I was excited and thought they'd come up with a way of installing certs into GAE in an automated manner, since that's been the biggest blocker of automated LE usage on GAE.

Thought about automating it with a sequence of API calls (get challenge, automatically create handler, deploy solution, get cert, modify it, upload it). However, Google is working on an automated solution, and I'm not sure deploying something for the intermediate is necessary https://issuetracker.google.com/issues/35900034 (but I still need certs in the intermediate).

It is not GAE but Google Cloud DNS right? So one needs to write a small app that uses that API to answer the challenge.

SSL certificates can now be updated in GAE using the gcloud command[1].

You could combine that with lego[2] to renew a Let's Encrypt SSL certificate via DNS Challenge to automate the process until native automation is implemented in GAE.

[1] https://cloud.google.com/appengine/docs/standard/python/usin... [2] https://thornelabs.net/2016/11/08/use-lego-gcloud-dns-and-dn...

Oh hot damn!

I've been waiting on API access to manage certs for a while.

Agreed! I also wish there was an automated way to renew! However currently there isn't, and I doubt building out the tooling is worth it given Google appears to be working on an integration themselves: https://issuetracker.google.com/issues/35900034 -- in the intermediate, I still need certificates though.

"LetsEncrypt issues SSL certificates by automatically verifying that you have ownership of the domain you claim you have."

Let's Encrypt does not verify ownership of domains. We verify control.

This is a common mistake, but the difference between ownership and control is significant so I'm just pointing this out for general educational purposes.

Thank you! Good point.

The fact that setting up SSL on Google's platform in 2017 requires reading a long article and repeating steps is really bad publicity - if this post is official it ought to be embarrassing. AWS, Heroku, Cloudflare have all moved on to automated certificate management for all their hosted services.

http://docs.aws.amazon.com/acm/latest/userguide/acm-overview...

https://devcenter.heroku.com/articles/automated-certificate-...

https://www.cloudflare.com/ssl/

Looks like it's coming soon: https://issuetracker.google.com/issues/35900034

Yup! I even link to the Amazon one in the tutorial, Google's is coming soon (https://issuetracker.google.com/issues/35900034), and in the meanwhile this helps you get a cert.

Is this App Engine specific? Or will this also apply to https://cloud.google.com/load-balancing/ ?

For the Container Engine part of GCP (and any Kubernetes installation really), this project automates everything away : https://github.com/jetstack/kube-lego

+1 well worth checking this tool out. Saved me a lot of effort setting up a GCP Kubernetes deployment two months ago. So far it has been a matter of set it and forget it.

I wrote up a gist for my own memory: https://gist.github.com/charlieegan3/37c854f50198711a1b5e216... - it runs certbot in a container rather than installing it.

I recently moved my static site from app engine to S3 and cloudfront so I could take advantage of ACM certificates (as well as playing around with some more terraform).

Click of a button certs with automated renewal is coming.

Do you have any links with more information on this?

https://issuetracker.google.com/issues/35900034

Google is going to be providing automatic SSL Certs soon: https://issuetracker.google.com/issues/35900034

Renewing/replacing certificates, especially with App Engine, is the bane of my existence. I couldn't possibly imagine doing this every 3 months.

This being said, I appreciate the tutorial.

Isn't it possible to call a Dns api and Google's Api to set the Txt record in dns and cleanup hook to set the certificates in Google respectively?

People have different DNSs. I'm using Namecheap and GAE for example.

I'm looking for a way to automate the process. Has anyone got any ideas?

Work in progress but: https://github.com/hatstand/gacertsbot/blob/master/appengine...

Currently relies on a fix to the appengine go SDK though: https://github.com/golang/appengine/pull/82

Wait so does this work?

Should do if you manually patch your local SDK.

If you have a Kubernetes cluster you can use https://github.com/PalmStoneGames/kube-cert-manager. Certbot (https://certbot.eff.org/) also has several configurations.

>Sign up to enjoy the full Medium experience.

wow fuck medium

What's the advantage of running the API in google app engine as opposed to a google cloud VM instance that you can just SSH into? Setting up letsencrypt on a VM instance is 10x easier than this (and in my experience everything else you need to do is 10x easier).

For a lot of smaller projects, running google app engine is 10x easier (and cheaper) then worry about a VM.

Reply on news.ycombinator.com