custom domain SSL in app engine

Question

My application has the following urls:

• client-1.myapp.appspot.com
• client-2.myapp.appspot.com

I want to use a custom subdomains:

• client-1.myapp.com
• client-2.myapp.com

To do this:

• I added a txt record to myapp.com and verified my domain.
• Then I added a cname record for *.myapp.com to ghs.googlehosted.com.

This works great, when client-3 comes along I dont even need to set anything up (except in my code). However, a client will eventually want to use their own domain instead of mine.

For Example:

• sub.client-1-website.com
• client-2-website.org

If my app was in a normal lamp stack they could just do a cname record for sub.client-1-website.com to client-1.myapp.com (or client-2-website.org to client-2.myapp.com). My app would then have a vhost that points that to the correct location.

In app engine if that's all they did it would lead to a 404 page. I must go into my add dashboard, verify the domain as mine, add it as one of my custom domains, then they can cname sub.client-1-website.com to client-1.myapp.com (or ghs.googlehosted.com.).

This means my clients must add and keep a google-verification txt record in their dns.

Is it possible to have app engine route the request based on the domain they were cnamed to? sub.client-1-website.com -cname-> client-1.myapp.com -cname-> client-1.myapp.appspot.com So app engine would route based on client-1.myapp.appspot.com I have a feeling the answer is no. This would be due to a limitation of how cnames work (not some a limitation in app engine). Is that correct?

At the end of the day this isn't a deal breaker. Its just one extra step for me and my client. However, things get super hairy when we add SSL into the mix.

I know how to set up SSL for *.myapp.com though Google Apps. It is annoying that I have to go through Google Apps, but not a deal breaking because only I need to do that.

However, if my client wants to use their own domain (sub.client-1-website.com and client-2-website.org) they too would need to go though Google Apps to have SSL work wouldn't they?

Is there another way for my clients to be able to add SSL?

Answer 1

As of September 2015, AppEngine SSL is no longer based on Google Apps. Through the appengine console, you can add client-1-website.com as a custom domain, verify ownership of it, and then add an SSL certificate for that domain.

I think you'll find the original domain name in the request headers but I haven't checked.