Skip to content

Latest commit

 

History

History
61 lines (39 loc) · 2.24 KB

README.md

File metadata and controls

61 lines (39 loc) · 2.24 KB
Raw

Let's Encrypt for App Engine

This App Engine module automatically keeps the SSL certificates on your App Engine app up-to-date using Let's Encrypt. Everything is done by your App Engine app - there's no need to touch a commandline, manually upload challenge reponses, or upload certificates to the Cloud Console.

Getting started

  1. Check out the code.

    go get github.com/hatstand/gacertsbot/appengine
cd ${GOPATH:-~/go}/src/github.com/hatstand/gacertsbot/appengine

  2. Deploy the module to your cloud project.

    gcloud app deploy

    This will create a new module called ssl-certificates in your App Engine app.

  3. Update your dispatch.yaml to route requests to this module. Add the following two sections:

    dispatch:
  - url: "*/.well-known/acme-challenge/*"
    service: ssl-certificates    
  - url: "*/ssl-certificates/*"
    service: ssl-certificates

    And then deploy it with:

    gcloud app deploy dispatch.yaml

  4. Enable the Google App Engine API in your cloud project if it's not enabled already. This allows the module to upload new SSL certificates.

    https://console.developers.google.com/apis/api/appengine.googleapis.com/overview

  5. Visit the status page. This will automatically register a new account with Let's Encrypt.

     http://YOUR_DOMAIN/ssl-certificates/status

    You'll be prompted to add your App Engine service account as an authorized owner of your domain in Google's Webmaster Tools if it isn't already.

  6. (Optional) Add an entry to your cron.yaml to automatically renew certificates when they're 30 days away from expiry. Add the following section:

    cron:
- description: "Renew SSL certificates"
  url: /ssl-certificates/auto-renew
  schedule: every monday 00:00
  retry_parameters:
    job_retry_limit: 5
    min_backoff_seconds: 60
    max_backoff_seconds: 600

    And then deploy it with:

    gcloud app deploy cron.yaml

Troubleshooting

If you are still getting 403 errors after enabling the App Engine Admin API, you may also need to grant the default service account the App Engine Admin IAM role.