Letsencrypt certificate renewal process is awful!

So, my free 90 days letsencrypt certificate is about to expire.

I tried the auto-renew feature, but it does not work in manual mode. They intend it to be run automated and unattended, but I can't do that because I want to use the certificate on google app engine.

So basically, you have to re-issue the certicate , which means updating the challenge response on your website.

Well, I did all that, and generated a new certificate.

Unfortunately it expires the same time as the certificate I want to replace... WTF?

Anyway, I cleaned out /etc/letsencrypt and tried again from scratch:

sudo ./letsencrypt-auto certonly -a manual --rsa-key-size 2048 --email webmaster@mydomain.org.au -d shop.rhubarbfood.org.au

and this time it generated me a certificate with the correct expiry date. For future reference,

fullchain.pem is the public cert that appengine wants.

The private key needs to be fixed for google app engine:

openssl rsa -inform pem \

  -in /etc/letsencrypt/live/mydomain.org.au/privkey.pem \
  -outform pem 

the output of this command can be pasted straight into the text box in the appengine certificate page.

This time I documented it so I can rmember in 90 days time when I need to renew it again!

Let's Encrypt and Google App Engine... not a match in heaven

I recently got on the SSL bandwagon for a site I manage, and bought an SSL certificate from GoDaddy for less than $10 (I can't remember exactly), but it only lasted a year.

True to form, when time came up for renewal GoDaddy wanted to charge me $100.

Top Tip: Never, ever allow GoDaddy to autorenew anything you buy from them. Because they alway jack the price up when they autorenew by default.

Anyway, I heard about LetsEncrypt, the new CA which offers SSL certificates for free.

"This must be too good to be true", I thought. And once again, I was proved right.

After much yak-shaving, (installing the prerequisites on my mac, the letsencrypt software, and the appropriate challenge/responses to prove I owned the web servers) I actually managed to sucessfully generate my certificate...

...which expires in 90 days!?!

Now the people at letsencrypt think that 90 days is a really, really long time, and any longer would be a security risk. And they say, "Hey, you should automate all your certificate issuance/renewal/web hosting malarky".

The only problem is, THERE IS NO API TO AUTOMATE UPLOADING OF YOUR CERTIFICATE TO GOOGLE APP ENGINE!!!

So, every 90 days, you will have to do it manually.


And one more thing... when I tried to upload my 4096 bit key certificate, app engine complained with an extremely generic error message. Turns out it only supports a maximum of 2048 bit keys.

Way to be cutting edge Google!

EDIT: Google App Engine has finally automated SSL certifcates issuance and renewal!!!

https://cloudplatform.googleblog.com/2017/09/introducing-managed-SSL-for-Google-App-Engine.html