News for hackers. Stuff that matters.

A comment on Automate Public Certificates Lifecycle Management via RFC 8555 (ACME). Parent comment

Re:Automate Public Certificates Lifecycle Management via RFC... by Thorrez on Tuesday April 12, 2022 @01:01AM (#30998812)
>up till, I guess now, Google Cloud TLS is just LetsEncrypt.

Google Cloud has been issuing certs for customer use off its own CA ( pki.goog ) for a while. It went GA April 27, 2020:

https://cloud.google.com/load-balancing/docs/release-notes#A...

You can see the documentation here:

https://cloud.google.com/load-balancing/docs/ssl-certificate...

GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down. Or you can restrict the load balancer to just get certs one of them by using a DNS CAA record.

Up till now, you could only use pki.goog with GCP load balancers. This new release allows pki.goog to be used with anything, because you actually control the private key.

Disclosure: I work in Google Cloud.

[ Parent | on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC... by francislavoie on Tuesday April 12, 2022 @01:26AM (#30998933)
> GCP load balancers can automatically switch between pki.goog and letsencrypt.org if one goes down.

Awesome, glad to see other ACME clients using issuer fallback, like Caddy does!

Do you know if there are any plans to making the Google ACME CA usable without registration? Having to register for an account and using credentials is a huge barrier to entry for many less-technical users. Caddy is able to use LE and ZeroSSL because they both don't _require_ accounts (ZeroSSL recommends it, partially as an upsell, but it's not necessary).

The more no-registration CAs exist, the more resilient ACME clients can be.

[ Parent | on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC... by Thorrez on Wednesday April 13, 2022 @12:42AM (#31011250)
Sorry, I don't know the plans. I don't work on that team.
[ Parent | on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC... by XorNot on Tuesday April 12, 2022 @02:00AM (#30999132)
Mid-year 2020 is not what I'd call running a service for "a while". That means its been GA just long enough to drop out of college.
[ Parent | on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC... by Thorrez on Wednesday April 13, 2022 @12:40AM (#31011240)
You could drop out after one day. If you drop out fast enough you might qualify for a refund.

I heard of someone who enrolls in a community college every winter, then goes skiing on a student discount, then drops out quickly and gets a refund. Not very ethical...

Sorry, this was completely unrelated to your point.

[ Parent | on HN ]