Deploy a global Google-managed certificate with Certificate Authority Service

This tutorial shows you how to use Certificate Manager to deploy aglobal Google-managed certificate withCertificate Authority Service.

The following global load balancers support Google-managed certificates with Certificate Authority Service:

  • Global external Application Load Balancer
  • Classic Application Load Balancer
  • Global external proxy Network Load Balancer

If you want to deploy to cross-region load balancers or regional load balancers,see the following:

Objectives

This tutorial shows you how to complete the following tasks:

  • Create a Google-managed certificate with CA Service by usingCertificate Manager.
  • Deploy the certificate to a supported load balancer by using a target HTTPSproxy.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.
    Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Compute Engine, Certificate Manager, Certificate Authority APIs.

    Roles required to enable APIs

    To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

    Enable the APIs

  5. Install the Google Cloud CLI.

    Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.

  6. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  7. Toinitialize the gcloud CLI, run the following command:

    gcloudinit

  8. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.
    Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

    Go to project selector

  9. Verify that billing is enabled for your Google Cloud project.

  10. Enable the Compute Engine, Certificate Manager, Certificate Authority APIs.

    Roles required to enable APIs

    To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

    Enable the APIs

  11. Install the Google Cloud CLI.

    Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.

  12. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  13. Toinitialize the gcloud CLI, run the following command:

    gcloudinit
  14. Enable theCA Service API.
  15. Create aCA pool. You must create and enable at least one CA in this CA pool.

You need to make a note of the following before you follow the steps of thistutorial:

  • Certificates you create with Certificate Authority Service aren't publicly trusted. Toissue publicly trusted certificates, create certificates withDNSauthorization orloadbalancer authorization.

  • If acertificate issuancepolicy is ineffect on the target CA pool, certificate provisioning might fail for any ofthe following reasons:

    • The certificate issuance policy has blocked the requested certificate.In this case, you aren't billed because the certificate hasn't beenissued.
    • The policy has applied changes to the certificate that aren't supportedby Certificate Manager. In this case, you are billed becausethe certificate has been issued, even though it is not fully compatible with Certificate Manager.

  • Global Google-managed TLS certificates can be configured to be issued from a CA pool in any region.

Required roles

Make sure that you have the following roles to complete the tasks in this tutorial:

  • Certificate Manager Owner (roles/certificatemanager.owner)

    Required to create and manage Certificate Manager resources.

  • Compute Load Balancer Admin (roles/compute.loadBalancerAdmin) or Compute Network Admin (roles/compute.networkAdmin)

    Required to create and manage HTTPS target proxy.

  • CA Service Admin (roles/privateca.admin)

    Required to perform actions within CA Service.

For more information, see the following:

Note: If you aren't assigned the permissions or roles, request the missing rolesfrom the Identity and Access Management (IAM) administrator who has the ProjectIAM Admin role (roles/resourcemanager.projectIamAdmin).

Create the load balancer

This tutorial assumes that you've already created and configured the loadbalancer's backends, health checks, backend services, and URL maps. If you'vecreated an external Application Load Balancer, note the name of the URL map because you need itlater in this tutorial.

If you haven't created the load balancer, see the following pages to create one:

Configure CA Service integration with Certificate Manager

To integrate CA Service withCertificate Manager, follow these steps:

  1. In the target Google Cloud project, create aCertificate Manager service account:

    gcloud beta services identity create --service=certificatemanager.googleapis.com \    --project=PROJECT_ID

    ReplacePROJECT_ID with the ID of the targetGoogle Cloud project.

    The command returns the name of the created service identity. See thefollowing example:

    service-520498234@gcp-sa-certificatemanager.iam.gserviceaccount.com

  2. Grant the Certificate Manager service account theCAService Certificate Requesterrole(roles/privateca.certificateRequester) within the target CA pool:

    gcloud privateca pools add-iam-policy-bindingCA_POOL \    --locationLOCATION \    --member "serviceAccount:SERVICE_ACCOUNT" \    --role roles/privateca.certificateRequester

    Replace the following:

    • CA_POOL: the ID of the target CA pool.
    • LOCATION: the target Google Cloud location.
    • SERVICE_ACCOUNT: the full name of the service accountyou created in step 1.

  3. Create a certificate issuance configuration resource for your CA pool:

    Console

    1. In the Google Cloud console, go to theIssuance configs tab on theCertificate Manager page.

      Go to Certificate Manager

    2. ClickCreate. TheCreate a Certificate Issuance Config pageappears.

    3. In theName field, enter a unique name for the certificateissuance configuration.

    4. Optional: In theDescription field, enter a description for theissuance configuration.

    5. ForLocation, selectGlobal.

    6. Optional: In theLifetime field, specify the lifetime of issuedcertificate in days. The value must be between 21 to 30 days (inclusive).

    7. Optional: In theRotation window percentage, specify thepercentage of the certificate's lifetime when its renewal process begins.To find the range of valid values, seeLifetime and Rotation windowpercentage.

    8. Optional: From theKey algorithm list, select the key algorithm touse when generating the private key.

    9. From theCA pool list, select the name of the CA pool to assign tothis certificate issuance configuration resource.

    10. In theLabels field, specify labels to associate to thecertificate. To add a label, clickAdd label, and specify a key and a value for your label.

    11. ClickCreate.

    gcloud

    gcloud certificate-manager issuance-configs createISSUANCE_CONFIG_NAME \    --ca-pool=CA_POOL

    Replace the following:

    • ISSUANCE_CONFIG_NAME: the name of the certificateissuance configuration resource.
    • CA_POOL: the full resource path and name of the CApool that you want to assign to this certificate issuance configurationresource.
    Note: By default, the certificate's lifetime is 30 days, the key algorithm isrsa-2048, and rotation window percentage is 66%. If you want tochange the default values, add thelifetime,key-algorithm, androtation-window-percentage flags to the command and specify the values.

    For more information about certificate issuance configuration resources,seeManage certificate issuance configuration resources.

Create a Google-managed certificate issued by your CA Service instance

To create a Google-managed certificate issued by your CA Serviceinstance, do the following:

Console

  1. In the Google Cloud console, go to theCertificate Manager page.

    Go to Certificate Manager

  2. On theCertificates tab, clickAdd Certificate.

  3. In theCertificate name field, enter a unique name for thecertificate.

  4. Optional: In theDescription field, enter a description for thecertificate. The description lets you identify the certificate.

  5. ForLocation, selectGlobal.

  6. ForScope, selectDefault.

  7. ForCertificate type, selectCreate Google-managed certificate.

  8. ForCertificate Authority type, selectPrivate.

  9. In theDomain Names field, specify a comma-delimited list of domainnames of the certificate. Each domain name must be a fully qualifieddomain name, such asmyorg.example.com.

  10. ForSelect a certificate issuance config, select the name of thecertificate issuance configuration resource referencing the target CApool.

  11. In theLabels field, specify labels to associate to thecertificate. To add a label, click

  12. ClickCreate.

    The new certificate appears in the list of certificates.

gcloud

To create a global Google-managed certificate with Certificate Authority Service,use thecertificate-manager certificates createcommandwith theissuance-config flag:

gcloud certificate-manager certificates createCERTIFICATE_NAME \    --domains="DOMAIN_NAMES" \    --issuance-config=ISSUANCE_CONFIG_NAME

Replace the following:

  • CERTIFICATE_NAME: the name of the certificate.
  • DOMAIN_NAME: the name of the target domain. The domain name must be a fully qualified domain name, such asmyorg.example.com.
  • ISSUANCE_CONFIG_NAME: the name of the certificate issuance configuration resource that references the target CA pool.

API

Create the certificate by making aPOST request to thecertificates.create method as follows:

POST /v1/projects/PROJECT_ID/locations/global/certificates?certificate_id=CERTIFICATE_NAME"{ "managed": {  "domains": ["DOMAIN_NAME"],  "issuanceConfig": "ISSUANCE_CONFIG_NAME", }}

Replace the following:

  • PROJECT_ID: the ID of the Google Cloud project.
  • CERTIFICATE_NAME: the name of the certificate.
  • DOMAIN_NAME: the name of the target domain. The domain name must be a fully qualified domain name, such asmyorg.example.com.
  • ISSUANCE_CONFIG_NAME: the name of the certificate issuance configuration resource that references the target CA pool.

Verify the status of the certificate

Before deploying a certificate to a load balancer, verify that it's active. Itcan take several minutes for the certificate state to change toACTIVE.

Console

  1. In the Google Cloud console, go to theCertificate Manager page.

    Go to Certificate Manager

  2. On theCertificates tab, check theStatus column for thecertificate.

gcloud

To verify the status of the certificate, run the following command:

gcloud certificate-manager certificates describeCERTIFICATE_NAME

ReplaceCERTIFICATE_NAME with the name of the targetGoogle-managed certificate.

The output is similar to the following:

createTime: '2021-10-20T12:19:53.370778666Z'expireTime: '2022-05-07T05:03:49Z'managed:  domains:  - myorg.example.com  issuanceConfig: projects/myproject/locations/global/issuanceConfigs/myissuanceConfig  state: ACTIVEname: projects/myproject/locations/global/certificates/mycertificatepemCertificate: |  -----BEGIN CERTIFICATE-----  [...]  -----END CERTIFICATE-----sanDnsnames:  - myorg.example.comupdateTime: '2021-10-20T12:19:55.083385630Z'

For more troubleshooting steps, seeTroubleshoot Certificate Manager.

Deploy the certificate to a load balancer

To deploy the global Google-managed certificate, usea certificate map.

Create a certificate map

Create a certificate map that references the certificate map entry associatedwith your certificate:

gcloud

To create a certificate map, use thegcloud certificate-manager maps create command:

gcloud certificate-manager maps createCERTIFICATE_MAP_NAME

ReplaceCERTIFICATE_MAP_NAME with the name of the targetcertificate map.

Terraform

To create a certificate map, you can use agoogle_certificate_manager_certificate_map resource.

resource "google_certificate_manager_certificate_map" "certificate_map" {  name        = "${local.name}-certmap-${random_id.tf_prefix.hex}"  description = "${local.domain} certificate map"  labels = {    "terraform" : true  }}

Create a certificate map entry

Create a certificate map entry and associate it with your certificate andcertificate map:

gcloud

To create a certificate map entry, use thegcloud certificate-manager maps entries create command:

gcloud certificate-manager maps entries createCERTIFICATE_MAP_ENTRY_NAME \    --map="CERTIFICATE_MAP_NAME" \    --certificates="CERTIFICATE_NAME" \    --hostname="HOSTNAME"

Replace the following:

  • CERTIFICATE_MAP_ENTRY_NAME: the name of the certificate map entry.
  • CERTIFICATE_MAP_NAME: the name of the certificate map to which the certificate map entry is attached.
  • CERTIFICATE_NAME: the name of the certificate you want to associate with the certificate map entry.

  • HOSTNAME: the hostname that you want to associate with the certificate map entry.

    If you want to create a certificate that covers both a wildcard domainand a root domain, then specify the hostname with a root and a wildcard,such asexample.com and*.example.com. In addition, you must specifytwo certificate map entries - one forexample.com and the other for*.example.com.

Terraform

To create a certificate map entry with a root domain, use agoogle_certificate_manager_certificate_map_entry resource.

resource "google_certificate_manager_certificate_map_entry" "first_entry" {  name        = "${local.name}-first-entry-${random_id.tf_prefix.hex}"  description = "example certificate map entry"  map         = google_certificate_manager_certificate_map.certificate_map.name  labels = {    "terraform" : true  }  certificates = [google_certificate_manager_certificate.root_cert.id]  hostname     = local.domain}

To create a certificate map entry with a wildcard domain, use agoogle_certificate_manager_certificate_map_entry resource.

resource "google_certificate_manager_certificate_map_entry" "second_entry" {  name        = "${local.name}-second-entity-${random_id.tf_prefix.hex}"  description = "example certificate map entry"  map         = google_certificate_manager_certificate_map.certificate_map.name  labels = {    "terraform" : true  }  certificates = [google_certificate_manager_certificate.root_cert.id]  hostname     = "*.${local.domain}"}

Verify that the certificate map entry is active

Verify that the certificate map entry is active before attaching itscorresponding certificate map to the target proxy.

To verify the certificate map entry, use thegcloud certificate-manager maps entries describe command:

gcloud certificate-manager maps entries describeCERTIFICATE_MAP_ENTRY_NAME \    --map="CERTIFICATE_MAP_NAME"

Replace the following:

  • CERTIFICATE_MAP_ENTRY_NAME: the name of the certificate map entry.
  • CERTIFICATE_NAME: the name of the certificate you want to associate with the certificate map entry.

The output is similar to the following:

certificates:createTime: '2021-09-06T10:01:56.229472109Z'hostname: example.comname: projects/my-project/locations/global/certificateMaps/myCertMap/certificateMapEntries/myCertMapEntrystate: ACTIVEupdateTime: '2021-09-06T10:01:58.277031787Z'

Attach the certificate map to the target proxy

You can attach the certificate map to a new target proxy or an existing targetproxy.

gcloud

To attach the certificate map to a new target proxy, use thegcloud compute target-https-proxies create command:

gcloud compute target-https-proxies createPROXY_NAME \    --certificate-map="CERTIFICATE_MAP_NAME" \    --url-map="URL_MAP" \    --global

Replace the following:

  • PROXY_NAME: the name of the target proxy.
  • CERTIFICATE_MAP_NAME: the name of the certificate map referencing the certificate map entry and theassociated certificate.
  • URL_MAP: the name of the URL map

To attach the certificate map to an existing target HTTPS proxy, use thegcloud compute target-https-proxies update command. If you don't know the name of the existingtarget proxy, go to theTarget proxies page and note the name of thetarget proxy.

gcloud compute target-https-proxies updatePROXY_NAME \    --certificate-map="CERTIFICATE_MAP_NAME" \    --global

After creating or updating the target proxy, run the following command toverify it:

gcloud compute target-https-proxies list

Terraform

To attach the certificate map to the target proxy, you can use agoogle_compute_target_https_proxy resource.

When configuring a target proxy, if you attach TLS (SSL) certificates directlyand also through a certificate map, the proxy uses the certificates referencedby the certificate map and ignores the directly attached TLS (SSL) certificates.

Troubleshooting certificates issued by CA Service

For troubleshooting steps, seeProblems related to certificates issued by a CA Service instance.

Clean up

To avoid incurring charges to your Google Cloud account for the resourcesused in this tutorial, delete them.

  1. Delete the load balancer and its resources.

    SeeClean up a load balancing setup.

  2. Delete or detach the certificate map from the proxy.

    To delete the certificate map, run the following command:

    gcloud compute target-https-proxies deletePROXY_NAME

    If you want to keep the target HTTPS proxy, then detach thecertificate map from the proxy.

    Caution: Before you detach the certificate map, notethe following considerations.
    • If there are any TLS (SSL) certificates attached directly to the proxy,then detaching the certificate map causes the proxy to resume using thosedirectly attached TLS (SSL) certificates.
    • If there are no TLS (SSL) certificates attached directly to the proxy,then the certificate map can't be detached from the proxy. You must firstattach at least one TLS (SSL) certificate directly to the proxy beforeyou can detach the certificate map.

    To detach the certificate map, run the following command:

    gcloud compute target-https-proxies updatePROXY_NAME \    --clear-certificate-map

    ReplacePROXY_NAME with the name of the target proxy.

  3. Delete the certificate map entry from the certificate map:

    gcloud certificate-manager maps entries deleteCERTIFICATE_MAP_ENTRY_NAME \    --map="CERTIFICATE_MAP_NAME"

    Replace the following:

    • CERTIFICATE_MAP_ENTRY_NAME: the name of the certificate map entry.
    • CERTIFICATE_MAP_NAME: the name of the certificate map.

  4. Delete the certificate map:

    gcloud certificate-manager maps deleteCERTIFICATE_MAP_NAME

    ReplaceCERTIFICATE_MAP_NAME with the name of thecertificate map.

  5. Delete the Google-managed certificate:

    Console

    1. In the Google Cloud console, go to theCertificate Manager page.

      Go to Certificate Manager

    2. On theCertificates tab, select the checkbox of thecertificate.

    3. ClickDelete.

    4. In the dialog that appears, clickDelete to confirm.

    gcloud

    gcloud certificate-manager certificates deleteCERTIFICATE_NAME

    ReplaceCERTIFICATE_NAME with the name of the targetcertificate.

  6. Delete the certificate issuance configuration resource:

    Console

    1. In the Google Cloud console, go to theIssuance configs tab on theCertificate Manager page.

      Go to Certificate Manager

    2. Select the checkbox of the issuance configuration resource that youwant to delete.

    3. ClickDelete.

    4. In the dialog that appears, clickDelete to confirm.

    gcloud

     gcloud certificate-manager issuance-configs deleteISSUANCE_CONFIG_NAME

    ReplaceISSUANCE_CONFIG_NAME with the name of the target certificate issuance configuration resource.

  7. Delete the CA pool.

    To delete the CA pool, or to disable the last enabled CA in a CA poolreferenced by a certificate issuance configuration resource, delete allcertificate issuance configuration resources that reference the CA pool. Formore information, seeDelete a CApool.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.