SSL Firebase 云函数证书

Question

Strange request, but is it possible to get a SSL certificate for my Firebase cloud functions?

I can't find anything about this online, just just vague stackoverflow answer

Answer 1

SSL for cloudfunctions.net

Google has a "miscellaneous" SSL certificate that certifies connections to cloudfunctions.net and it's subdomains called misc.google.com (which isn't a website) (this certificate is shared by 150+ miscellaneous domains under the Google umbrella). This certificate is used whenever you try to connect to one of your cloud functions when it's web address starts with https://<region>-<project-id>.cloudfunctions.net . You can see this certificate for yourself by visiting the URL of one of your functions and obtaining the certificate from the padlock icon next to the URL.

SSL for Cloud Functions behind Firebase Hosting

You can use rewrites on Firebase Hosting to serve your Cloud Functions from the same domain as your website and these connections will use the same SSL certificate issued to your domain. In a similar fashion to the cloudfunctions.net domain, the certificate used for this is shared amongst around 100 unrelated domains hosted using Firebase Hosting (which helps keep costs down for Firebase, but not harming security all too much).

Note: When hosting functions behind Firebase Hosting, the results of your functions may be cached by the Firebase Hosting CDN and because the CDN is internal to the Firebase.network, your function may be called using only HTTP rather than HTTPS. As an example, if you have a HTTPS Function called somefunction at https://functionsexample.com/somefunction , in addition to using the SSL certificate for functionsexample.com , the request will first hit the Firebase CDN, and if not cached, the CDN will call http://<region>-<projectid>.cloudfunction.net/somefunction (with x-appengine-* headers) and pass the result back, caching it as appropriate. In my experience you can detect these "HTTP-call-from-the-CDN" requests by looking at the x-appengine-https header. (This last bit of info may be outdated, probably subject to change at any time and likely to be corrected in this answer's comments by Frank, Doug or an actual Firebase staff member)