3

We currently have a self-hosted solution that allows our customers to add CNAMES to access their content through their own domains.

We're moving the entire stack to Google Cloud, with the main product residing on a Firebase Hosting deployment, with serverless functions, storage and Firestore databases.

I am aware that we can manually and programatically add CNAMES to our Firebase hosting account, but there is a hard limit of 20 on Firebase.

My question: does GCP offer a solution where we can programatically add CNAMES, generate a self signed certificate, and point them via a proxy to our Firebase hosting URL, while retaining the originating CNAME, but serving our Firebase content? Or recommended approaches for this stack?

Things we don't want to do:

  • have multiple Firebase deployments with 20 domains each
  • Add any hosted solutions (compute engine etc) as an intermediary
  • Move away from Firebase

We have reached out to the Firebase team but was recommended point 1 above, split them between multiple deployments as they had no visibility to other GCP products.

Improve this question
12
  • 1
    The best place to ask what solutions GCP offer would be at GCP support.
    – Jenny D
    Jul 19, 2019 at 8:41
  • Thanks Jenny, GCP support points us to Firebase, Firebase points us to GCP. ¯_(ツ)_/¯
    – DavidP
    Jul 19, 2019 at 8:45
  • 3
    I don't see how anyone other than GCP/Firebase can know what solutions GCP/FIrebase are offering.
    – Jenny D
    Jul 19, 2019 at 8:47
  • 2
    Host your own Authoritive DNS and add anything you want.
    – Overmind
    Jul 19, 2019 at 9:21
  • 1
    @Overmind - your comment is incorrect. Firebase custom domains must be configured. Anything else will fail. The reason is that most GCP services are fronted by GFE/Load Balancer which uses the HTTP Host header to direct traffic. Unconfigured host names are considered invalid.
    – John Hanley
    Jul 20, 2019 at 1:07

1 Answer 1

Reset to default
2

The answer to your question is not how many hostnames Firebase can support, but how many hostnames SSL can support.

The SSL certificate recommendation is that no more than 20 entries be placed in the SAN field of an SSL certificate. This is called SSL certificate minting limits. Some SSL certificates do support up to 100*, but Firebase supports 20. The more entries, the more overhead to process each connection. Each time you add a new domain to the certificate all of the existing domains have to reverified as a new certificate is issued.

Note: I am not including wildcard (*.example.com)

*Note: RFC 5280 does not specify a maximum for SubjectAltNames. Microsoft imposes a maximum size of an encoded extension to be 4KB (link).

Improve this answer
2
  • 2
    Thanks John, as mentioned in my original post, we're aware of the hard limit, but your explanation makes it clear why there is a limit.
    – DavidP
    Jul 20, 2019 at 8:17
  • Can you provide a citation as to the "technical limit" of 100 subjectAltName entries in a single TLS certificate?
    – womble ♦
    Aug 2, 2019 at 1:14

Not the answer you're looking for? Browse other questions tagged .