Blog

Google App Engine supports HTTPS if you access your application through https://abc.appspot.com but not through https://www.abc.com. Google is working on a solution but there is currently no ETA. From a technology point of view, it comes down to the question of where your SSL is terminated. To have https, the certificate must reside on the server that fields the call. If it does not, your browser gives you a certificate error. Google has a generic *.appspot.com certificate at every app engine server but they don’t want to put a yourdomain.com certificate on servers in their infrastructure.

We blogged about it last year, envisioning a service to do this for other businesses. In this post, we take it a step further and describe the implementation.

The implementation uses an Amazon EC2 instance as a proxy server. There are three parts to setting up the proxy:

1. The foundation. A couple of years ago, Brad Larson described the process of setting up an EC2 server. His purpose was different but the first steps of our process are the same as what he described. Following his lead, bring up an instance of a CentOS AMI. A couple of AMIs we have used are ami-0193f760 in US-East and ami-e32273a6 in US-West (both from RightScale). Snap a 1GB EBS volume to it and attach an IP address. See Brad’s article for details.
2. The components. Squid requires just two components: mod_ssl and squid. Install them both using yum (or apt-get if you are using a different version of Linux).
3. Integration. A few steps to this:
   • Make sure to update /etc/hosts and add the line 01.23.45.67 www.abc.com www_abc.
   • Optional: for speed, add Google nameservers (or others good ones for your locale) to /etc/resolv.conf. To accomplish this, add the lines nameserver 8.8.8.8 and nameserver 8.8.4.4 to that file.
   • Finally, Squid Wiki Configuring SSL Reverse Proxy does a great job of walking through the steps of configuring the reverse proxy. We won’t reproduce the steps for creating a certificate. Here is the config file we use. Not much to it, declaring the SSL connection to the browser and to App Engine and tightening the security parameters.

   acl all src 0.0.0.0/0.0.0.0
   acl Safe_ports port 443
   acl gae dstdomain abc.appspot.com
   
   visible_hostname www.abc.com
   https_port 443 cert=/path/to/cert key=/path/to/key defaultsite=abc.appspot.com
   cache_peer abc.appspot.com parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER name=appspot
   cache_peer_access appspot allow gae
   always_direct allow gae
   
   http_access allow gae Safe_ports
   http_access deny all
   
   debug_options ALL,1

4. Debugging. For the novice, Squid can be a little cryptic. It was built for speed, not programming ease. Here are a few hints on what to do when things don’t work according to plan:
   • If squid won’t even start, squid –N –d l -D can be useful in figuring out why.
   • If it starts but does not behave as you would expect, that last line (debug_options command) can be used to control the level of detail that is logged. Reading those logs can be a bit of a black art. Use your favorite search engine and the Squid book for help.
5. Operation. Once you have a basic configuration running, tighten up the security and optimize it for performance. We will be adding to this section in the future but here is a good starting point: Six Things First Time Administrators Should Know.