Issue with a new SSL Cert (You must verify ownership of this certificate's domain(s)in order to upload it)

[Raphael Savina]

Hi all,

I'm trying to add HTTPS to an app but I'm stuck at the Upload cert page with the following:

You must verify ownership of this certificate's domain(s)in order to upload it.

This is the message:

Now, the domain (www) is already listed under Custom Domains:

 and the HTTP version of the app is working just fine.

My cert and key passed all he text from this page (what I followed):

https://cloud.google.com/appengine/docs/python/console/using-custom-domains-and-ssl#adding_ssl_to_your_custom_domain

The only 2 things I'm not sure about are:

-the ownership was before part of my Google Apps, now moved to the cloud console but I still can see the warning message:

"The custom domain feature has been migrated here from Google Apps. To get started, verify ownership of your domains by completing step 1 here."

-the cert is for www and without www but I have just www verified, would that be the issue?

Thank in advance for pointers or any advice!

Raphael

[Raphael Savina]

Answering my own query! :-)

It was an issue with having only www registered as a custom domain while the cert had both www and not-www. 

After adding the non-www as a custom domain it worked.

Raphael 

[Nicholas (Google Cloud Support)]

Thank you for posting your issue and solution here publicly. It is helpful for the community. Would you mind clarifying what you mean by non-www? Did you mean a wildcard subdomain like *.domain.com?

[Raphael Savina]

Hi Nicholas,

I meant I have:

www.example.com

example.com

both go to the same GAE App setup with 1 SSL cert. 

Also have added "secure: always" in my YAML file so that visitors will be always redirected to the HTTPS.

Thanks

Raphael

[Stephan Schultz]

I'm having the same issue right now. I followed the instructions but neither the technical support from namecheap nor I was able to get it to work.

• I added the custom domains for example.com and ww.example.com
• I obtained a certificate for example.com
• I loaded the concatenated .crt files
• I loaded the private key
• I get "You must verify ownership of this certificate's domain(s)in order to upload it."

I used the Certificate & Private Key / CSR Matcher and it is valid, but only for the example_com.crt file, not for the concatenated concat.crt file.

I'm out of ideas, please let me know what alse I could try.

[Huy Nguyen]

Hi Stephan,

My problem similar, 

My root domain my_domain.com NOT in GAE, sub domain sub.my_domain.com deployed in GAE

I added ssl certificate of namecheap for all subdomain but not success and message alert same you,

You have solved it yet. There are suggestions for me ?

Thanks you,

[Adam Jones]

I'm also having this issue. It suddenly stopped working, months before it expires. I also bought the certificate at NameCheap.

[Adam Jones]

I"m having the exact same issue. Was previously working fine. I also signed up with NameCheap.

On Thursday, April 7, 2016 at 6:44:05 AM UTC-7, Raphael Savina wrote:

[Arun Shanker Prasad]

I know this is an old post, but I am also having issues with an UCC certificate. Are there any workarounds?

[Attila-Mihaly Balazs]

I had similar issues. Try verifying your root domain (ie. "example.com") even if you're not planning on using it with GAE. That should solve the issue (although it's not at all intuitive).

Attila

[Arun Shanker Prasad]

Hi Attila,

Thanks for the response.

Yes, I ended up doing that, but the issue is that it does not let me adding the root domain as the www domain is already there, so we had to remove and add it again. The new interface automatically adds both the root domain and the www subdomain.

Also an important note, it looks like Google may have changed something recently, so we are not able to manage a domain even if you are an administrator of the application, we need to be the "verified" owner in webmaster tools.

Thanks,

Arun

[Attila-Mihaly Balazs]

Yep, the SSL interface is confusing (like, why do you have to verify the subdomain when you already verified the root domain? In what universe do you have control of the root domain but don't control the subdomain?).

Anyway, when adding the domain to appengine, at the second step you *can* remove the www one (I've done this Monday actually). So the workflow is something like:

- go to the setup page https://console.cloud.google.com/appengine/settings/domains?project=<your project>
- click "Add custom domain"
- select "Verify new domain" from the dropdown
- after completing verification in the webmaster tools, click the refresh button
- now it will display two text boxes (as you've said) one with "www.foo.com" and one with "foo.com" but you can use the X on "www.foo.com" (on the right end) to remove it and leave only "foo.com" (or the other way around).

Ie. you don't have to add both domains suggested by Google.

And a good point about having to be the verified of the domain in Webmaster tools.

Cheers,
Attila

[Arun Shanker Prasad]

Thanks Attila.

We also ended up doing the same, I removed the existing domain and added it back in again.

One important thing to note is that we need to be doing this from the same account that is linked to the domain in webmaster tools, that part is also confusing and not clearly mentioned anywhere.