Deploy a global Google-managed certificate with load balancer authorization

This tutorial shows you how to use Certificate Manager to deploy a global Google-managed certificate with load balancer authorization.

Load balancer authorization lets you obtain a Google-managed certificate for your domain when traffic is served by the load balancer. This method doesn't require any additional DNS records for certificate provisioning.

The following load balancers support Google-managed certificates with load balancer authorization:

  • Global external Application Load Balancer
  • Classic Application Load Balancer
  • Global external proxy Network Load Balancer
  • Classic proxy Network Load Balancer

Objectives

This tutorial shows you how to complete the following tasks:

  • Create a Google-managed certificate issued by a publicly trusted Certificate Authority (CA) with load balancer authorization by using Certificate Manager.
  • Deploy the certificate to a supported load balancer by using a target HTTPS proxy.

If you're deploying a certificate to a production domain, traffic is interrupted briefly while the certificate is set up and activated on your load balancer.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Compute Engine, Certificate Manager APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  5. Install the Google Cloud CLI.

  6. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  7. To initialize the gcloud CLI, run the following command: 

    gcloud init

  8. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  9. Verify that billing is enabled for your Google Cloud project.

  10. Enable the Compute Engine, Certificate Manager APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  11. Install the Google Cloud CLI.

  12. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  13. To initialize the gcloud CLI, run the following command: 

    gcloud init

Required roles

Make sure that you have the following roles to complete the tasks in this tutorial:

  • Certificate Manager Owner (roles/certificatemanager.owner)

    Required to create and manage Certificate Manager resources.

  • Compute Load Balancer Admin (roles/compute.loadBalancerAdmin) or Compute Network Admin (roles/compute.networkAdmin)

    Required to create and manage HTTPS target proxy.

  • DNS Administrator (roles/dns.admin)

    Required if you want to use Cloud DNS as your DNS solution.

For more information, see the following:

Domain names

To create certificates, get the fully qualified domain names (FQDNs) of the domains you own. If you don't have a domain, you can use Cloud Domains to register a domain.

Create the load balancer

This tutorial assumes that you've already created and configured the load balancer's backends, health checks, backend services, and URL maps. If you've created an external Application Load Balancer, note the name of the URL map because you need it later in this tutorial.

If you haven't created the load balancer, see the following pages to create one:

Create a Google-managed certificate with load balancer authorization

To create a Google-managed certificate with load balancer authorization, do the following:

Console

  1. In the Google Cloud console, go to the Certificate Manager page.

    Go to Certificate Manager

  2. On the Certificates tab, click Add Certificate.

  3. In the Certificate name field, enter a unique name for the certificate.

  4. Optional: In the Description field, enter a description for the certificate. The description lets you identify the certificate.

  5. For Location, select Global.

  6. For Scope, select Default.

  7. For Certificate type, select Create Google-managed certificate.

  8. For Certificate Authority type, select Public.

  9. In the Domain Names field, specify a comma-delimited list of domain names of the certificate. Each domain name must be a fully qualified domain name, such as myorg.example.com.

  10. For Authorization type, select Load balancer authorization.

  11. In the Labels field, specify labels to associate with the certificate. To add a label, click Add label, and specify a key and a value for your label.

  12. Click Create.

    The new certificate appears in the list of certificates.

gcloud

To create a global Google-managed certificate with load balancer authorization, use the