Deploy a regional self-managed certificate (original) (raw)

To secure communication for your regional external Application Load Balancers or regional internal Application Load Balancers, use Certificate Manager to deploy a self-managed certificate. This approach helps you use your own trusted certificates for your applications. This tutorial shows you how to deploy self-managed certificates specifically for regional load balancers. For global external or cross-region deployments, see the following:

Objectives

This tutorial shows you how to complete the following tasks:

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
    Roles required to select or create a project
    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission. Learn how to grant roles.
      Go to project selector
  3. Verify that billing is enabled for your Google Cloud project.
  4. Enable the Compute Engine, Certificate Manager APIs.
    Roles required to enable APIs
    To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.
    Enable the APIs
  5. Install the Google Cloud CLI.
  6. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.
  7. To initialize the gcloud CLI, run the following command:
    gcloud init

Required roles

Make sure that you have the following roles to complete the tasks in this tutorial:

For more information, see the following:

Create the load balancer

This tutorial assumes that you've already created and configured the load balancer's backends, health checks, backend services, and URL maps. Make a note of the URL map's name because you need it later in this tutorial.

Create a private key and certificate

To create a private key and a certificate, do the following:

  1. Use a trusted third-party certificate authority (CA) to issue the certificate along with its associated key.
  2. Verify that the certificate is properly chained and root-trusted.
  3. Prepare the following PEM-encoded files:
    • The certificate file (CRT)
    • The corresponding private key file (KEY)

For information about how to request and validate a certificate, see Create a private key and certificate.

Upload a self-managed certificate to Certificate Manager

To upload the certificate to Certificate Manager, do the following:

Console

  1. In the Google Cloud console, go to the Certificate Manager page.
    Go to Certificate Manager
  2. On the Certificates tab, click Add Certificate.
  3. In the Certificate name field, enter a unique name for the certificate.
  4. Optional: In the Description field, enter a description for the certificate. The description lets you identify the certificate.
  5. For Location, select Regional.
  6. From the Region list, select your region.
  7. For Certificate type, select Create self-managed certificate.
  8. For the Certificate field, do either of the following:
    • Click the Upload button and select your PEM-formatted certificate file.
    • Copy and paste the contents of a PEM-formatted certificate. The contents must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.
  9. For the Private key certificate field, do either of the following:
    • Click the Upload button and select your private key. Your private key must be PEM-formatted and not protected with a passphrase.
    • Copy and paste the contents of a PEM-formatted private key. The private keys must start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----.
  10. In the Labels field, specify labels to associate with the certificate. To add a label, clickAdd label, and specify a key and a value for your label.
  11. Click Create.
    The new certificate appears in the list of certificates.

gcloud

To create a regional self-managed certificate, run thecertificate-manager certificates create command:

gcloud certificate-manager certificates create CERTIFICATE_NAME
--certificate-file="CERTIFICATE_FILE"
--private-key-file="PRIVATE_KEY_FILE"
--location="LOCATION"

Replace the following:

Terraform

To upload a self-managed certificate, you can use agoogle_certificate_manager_certificate resource with the self_managed block.

API

Upload the certificate by making a POST request to thecertificates.create method as follows:

POST /v1/projects/PROJECT_ID/locations/LOCATION/certificates?certificate_id=CERTIFICATE_NAME { self_managed: { pem_certificate: "PEM_CERTIFICATE", pem_private_key: "PEM_KEY", } }

Replace the following:

Deploy the self-managed certificate to a load balancer

To deploy the self-managed certificate, attach it directly to the target proxy.

Attach the certificate directly to the target proxy

You can attach the certificate to a new target proxy or an existing target proxy.

To attach the certificate to a new target proxy, use the gcloud compute target-https-proxies createcommand:

gcloud compute target-https-proxies create PROXY_NAME
--certificate-manager-certificates=CERTIFICATE_NAME
--url-map=URL_MAP
--region=LOCATION

Replace the following:

To attach certificate to an existing target HTTPS proxy, use the gcloud compute target-https-proxies updatecommand. If you don't know the name of the existing target proxy, go to the Target proxiespage and note the name of the target proxy.

gcloud compute target-https-proxies update PROXY_NAME
--region=LOCATION
--certificate-manager-certificates=CERTIFICATE_NAME

After creating or updating the target proxy, run the following command to verify it:

gcloud compute target-https-proxies list

Clean up

To avoid incurring charges to your Google Cloud account for the resources used in this tutorial, delete the uploaded certificate:

gcloud certificate-manager certificates delete CERTIFICATE_NAME

Replace CERTIFICATE_NAME with the name of the target certificate.

If you don't plan to use the load balancer, delete the load balancer and its resources. See Clean up a load balancing setup.

What's next