Deploy a global Google-managed certificate with Certificate Authority Service

This tutorial shows you how to use Certificate Manager to deploy a global Google-managed certificate with Certificate Authority Service.

The following global load balancers support Google-managed certificates with Certificate Authority Service:

  • Global external Application Load Balancer
  • Classic Application Load Balancer
  • Global external proxy Network Load Balancer
  • Classic proxy Network Load Balancer

If you want to deploy to cross-region load balancers or regional load balancers, see the following:

Objectives

This tutorial shows you how to complete the following tasks:

  • Create a Google-managed certificate with CA Service by using Certificate Manager.
  • Deploy the certificate to a supported load balancer by using a target HTTPS proxy.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Compute Engine, Certificate Manager, Certificate Authority APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  5. Install the Google Cloud CLI.

  6. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  7. To initialize the gcloud CLI, run the following command: 

    gcloud init

  8. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  9. Verify that billing is enabled for your Google Cloud project.

  10. Enable the Compute Engine, Certificate Manager, Certificate Authority APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  11. Install the Google Cloud CLI.

  12. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  13. To initialize the gcloud CLI, run the following command: 

    gcloud init
  14. Enable the CA Service API.
  15. Create a CA pool. You must create and enable at least one CA in this CA pool.

You need to make a note of the following before you follow the steps of this tutorial:

  • Certificates you create with Certificate Authority Service aren't publicly trusted. To issue publicly trusted certificates, create certificates with DNS authorization or load balancer authorization.

  • If a certificate issuance policy is in effect on the target CA pool, certificate provisioning might fail for any of the following reasons:

    • The certificate issuance policy has blocked the requested certificate. In this case, you aren't billed because the certificate hasn't been issued.
    • The policy has applied changes to the certificate that aren't supported by Certificate Manager. In this case, you are billed because the certificate has been issued, even though it is not fully compatible with Certificate Manager.

  • To ensure compatibility, configure the target CA pool's certificate issuance policy to allow end-entity (leaf) server TLS certificates.

  • Global Google-managed TLS certificates can be configured to be issued from a CA pool in any region.

Required roles

Make sure that you have the following roles to complete the tasks in this tutorial:

  • Certificate Manager Owner (roles/certificatemanager.owner)

    Required to create and manage Certificate Manager resources.

  • Compute Load Balancer Admin (roles/compute.loadBalancerAdmin) or Compute Network Admin (roles/compute.networkAdmin)

    Required to create and manage HTTPS target proxy.

  • CA Service Admin (roles/privateca.admin)

    Required to perform actions within CA Service.

For more information, see the following:

Create the load balancer

This tutorial assumes that you've already created and configured the load balancer's backends, health checks, backend services, and URL maps. If you've created an external Application Load Balancer, note the name of the URL map because you need it later in this tutorial.

If you haven't created the load balancer, see the following pages to create one:

Configure CA Service integration with Certificate Manager

To integrate CA Service with Certificate Manager, follow these steps:

  1. In the target Google Cloud project, create a Certificate Manager service account:

    gcloud beta services identity create --service=certificatemanager.googleapis.com \
    --project=PROJECT_ID

    Replace PROJECT_ID with the ID of the target Google Cloud project.

    The command returns the name of the created service identity. See the following example:

    service-520498234@gcp-sa-certificatemanager.iam.gserviceaccount.com

  2. Grant the Certificate Manager service account the CA Service Certificate Requester role (roles/privateca.certificateRequester) within the target CA pool:

    gcloud privateca pools add-iam-policy-binding CA_POOL \
    --location LOCATION \
    --member "serviceAccount:SERVICE_ACCOUNT" \
    --role roles/privateca.certificateRequester

    Replace the following:

    • CA_POOL: the ID of the target CA pool.
    • LOCATION: the target Google Cloud location.
    • SERVICE_ACCOUNT: the full name of the service account you created in step 1.

  3. Create a certificate issuance configuration resource for your CA pool:

    Console

    1. In the Google Cloud console, go to the Issuance configs tab on the Certificate Manager page.

      Go to Certificate Manager

    2. Click Create. The Create a Certificate Issuance Config page appears.

    3. In the Name field, enter a unique name for the certificate issuance configuration.

    4. Optional: In the Description field, enter a description for the issuance configuration.

    5. For Location, select Global.

    6. Optional: In the Lifetime field, specify the lifetime of issued certificate in days. The value must be between 21 to 30 days (inclusive).

    7. Optional: In the Rotation window percentage, specify the percentage of the certificate's lifetime when its renewal process begins. To find the range of valid values, see Lifetime and Rotation window percentage.

    8. Optional: From the Key algorithm list, select the key algorithm to use when generating the private key.

    9. From the CA pool list, select the name of the CA pool to assign to this certificate issuance configuration resource.

    10. In the Labels field, specify labels to associate to the certificate. To add a label, click Add label, and specify a key and a value for your label.

    11. Click Create.

    gcloud 

    gcloud certificate-manager issuance-configs create ISSUANCE_CONFIG_NAME \
    --ca-pool=CA_POOL

    Replace the following:

    • ISSUANCE_CONFIG_NAME: the name of the certificate issuance configuration resource.
    • CA_POOL: the full resource path and name of the CA pool that you want to assign to this certificate issuance configuration resource.

    For more information about certificate issuance configuration resources, see Manage certificate issuance configuration resources.

Create a Google-managed certificate issued by your CA Service instance

To create a Google-managed certificate issued by your CA Service instance, do the following:

Console

  1. In the Google Cloud console, go to the Certificate Manager page.

    Go to Certificate Manager

  2. On the Certificates tab, click Add Certificate.

  3. In the Certificate name field, enter a unique name for the certificate.

  4. Optional: In the Description field, enter a description for the certificate. The description lets you identify the certificate.

  5. For Location, select Global.

  6. For Scope, select Default.