CODEWITHSUNDEEP
google-app-enginessl-certificatecloudflare
maddyblue
maddyblue

Reputation: 16882

Cloudflare Origin Certificate with Google App Engine

Cloudflare recently released origin certs. I can generate one for my domain but am not able to upload it to app engine. After getting the cert and key from cloudflare, I have to run openssl rsa -in old -out new on the key to convert it to an RSA key. Using this key and the cert, app engine shows the following error:

The SSL certificate provided could not be inserted.

With no additional information it's difficult to know what's going on here.

Upvotes: 3

Views: 1911

Answers (4)

pol
pol

Reputation: 81

For anyone reading this, a small issue you might face is that CloudFlare will generate private keys for Origin CA certificates with a -----BEGIN PRIVATE KEY----- line and this fails AppEngine's validation and that might imply some kind of conversion is necessary.

To get past, change it to -----BEGIN RSA PRIVATE KEY----- instead. The same applies for the end comment.

Upvotes: 7

Andrei
Andrei

Reputation: 198

05/DEC/2019 UPDATE: App Engine now supports Cloudflare Origin CA certificates.

One must convert private key to RSA format:

$ openssl rsa -in {key-name}.key -out {key-name-rsa}.key

and enable Cloudflare proxying (make sure cloud icon is orange in DNS settings).

Same here, seems like CloudFlare Origin certificates are not publicly trusted, this may be the issue.

CF support encourages to contact Google.

Update:

Bundling, i.e. "appending the appropriate root to your certificate and re-uploading" (Patrick) CloudFlare CA root Cert and Public certificates together does not help.

Same error message from Google App Engine: "The SSL certificate provided could not be inserted."

Upvotes: 1

Rohit Manglik
Rohit Manglik

Reputation: 367

As mentioned at https://support.cloudflare.com/hc/en-us/articles/221856168-How-to-install-an-Origin-CA-certificate-using-Google-App-Engine?flash_digest=c5309955213af4e33d15d0f9d2de9a4a186c10d2

At the present time, Google App Engine only allows the uploading of certificates that are either self-signed or are signed by a publicly trusted certificate authority (CA).

CloudFlare's CA for origin certificates is not publicly trusted, so Google App Engine currently returns an error when an Origin CA certificate is uploaded: "The SSL certificate provided could not be inserted."

We've reached out to Google regarding this policy decision and will update this article if the behavior changes.

Upvotes: 3

Patrick
Patrick

Reputation: 1474

CloudFlare PM here for Origin CA. A few comments/questions:

  1. Are you specifying RSA upfront, i.e., during issuance? Strange that you'd have to convert from RSA to RSA if so. If you're specifying ECDSA may be that GAE doesn't support those key types.
  2. As another answer indicated, our Origin CA certificates are intended to be used behind CloudFlare. By default they are leaf-only and have been reduced to the absolute minimum size that will work with our edge. Please see this blog post that I wrote for more details: https://blog.cloudflare.com/cloudflare-ca-encryption-origin.
  3. We've noticed that some software, e.g., cPanel, that can't determine a path all the way to a trusted root can be placated by appending our Origin CA root certificate. You can find these certificates here, one for RSA and one for ECDSA: https://support.cloudflare.com/hc/en-us/articles/218689638-What-are-the-root-certificate-authorities-CAs-used-with-CloudFlare-Origin-CA-. I would try appending the appropriate root to your certificate and re-uploading.

Upvotes: 2

Related Questions