Enable certificate-based access for web applications

This page describes how to enable certificate-based access (CBA) for your web applications. You can use CBA to secure access from trusted devices to enterprise web applications running on Google Cloud.

Overview

CBA for web applications uses the Chrome Enterprise Premium Context-Aware Access features and Google Cloud networking to secure access using mutual TLS (mTLS). Following are the main components that you work with to enable CBA for web applications:

  • Access Context Manager: lets you create access levels that require certificates when determining access to web applications.
  • Identity-Aware Proxy (IAP): authenticates user access to web applications.
  • Google Cloud HTTPS load balancer: provides mutual authentication (mTLS) between users and web applications.
  • Chrome Enterprise Policy: provides mutual authentication (mTLS) between users and web applications when using the Chrome browser.

Before you begin

Verify that you have a current version of the Google Cloud CLI by running the following command:

gcloud components update

Set up mTLS for the external HTTPS load balancer

Follow the instructions to set up the HTTPS external load balancer. Note the name of the target HTTPS proxy that is created, because you will need it in a later step.

Create a trust config

Create a trust config to represent your type of Public Key Infrastructure (PKI).

To complete this task, you must have the certificatemanager.trustconfigs.create permission on the target Google Cloud project.

You can create a trust config using a Google-issued certificate (Method 1), using your own certificate (Method 2), or using a self-signed certificate with Endpoint Verification (Method 3).

Method 1

Use a Google-issued certificate to create a trust config.

  1. Complete the steps to Create a root CA.

  2. Fetch the PEM file contents:

    gcloud privateca roots describe ROOT_CA_ID \
    --pool=POOL_ID \
    --location=CA_LOCATION \
    --format='value(pemCaCertificates)'

    Replace the following:

    • ROOT_CA_ID: The root certificate ID.
    • POOL_ID: The root certificate pool ID.
    • CA_LOCATION: The CA location.

  3. Retrieve the root certificate, returned in the pemCaCertificates field. The certificate is the string between the BEGIN CERTIFICATE and END CERTIFICATE markers, and includes both markers.

  4. Save the root certificate in PEM format to a file.

  5. Create a trust config:

    1. Set the following environment variables:

      ROOT_PEM_FILE=TRUST_ANCHOR_PATH
INT_PEM_FILE1=IM_CERT_PATH
INT_PEM_FILE2=SECOND_IM_CERT_PATH

      Replace the following:

      • TRUST_ANCHOR_PATH: The path to your PEM-encoded trust anchor.
      • IM_CERT_PATH: The path to your PEM-encoded intermediate certificate.