이 주제는 예시일 뿐입니다. 인증 기관(CA) Let's Encrypt에서 TLS 인증서를 가져오는 방법을 설명합니다.
이러한 단계는 주로 CA에서 승인한 인증서/키 쌍을 가져올 수 있는 다른 방법이 없는 경우에 수행하는 예시입니다. 이 예시에서는 Let's Encrypt CA, Certbot 클라이언트, Google Cloud Platform Cloud DNS를 사용하여 인증서를 생성하는 방법을 보여줍니다.
아직 Cloud DNS API를 사용 설정하지 않았으면 사용 설정하세요. API 사용 설정을 참조하세요.
고정 IP 주소를 만듭니다.
GKE를 사용하는 경우 고정 외부 IP 주소 구성의 안내에 따라 외부 프로세스가 하이브리드 런타임 인그레스와 통신하는 데 사용할 수 있는 고정 IP 주소를 만듭니다. 이 주소에 원하는 이름을 지정할 수 있습니다(예: apigee-hybrid-runtime). 완료되면 다음 단계의 클러스터 구성에서 IP 번호를 사용합니다. 예를 들면 34.66.75.196입니다.
Google Distributed Cloud를 사용 중인 경우 IP 주소 계획 및 사용자 클러스터 만들기의 안내에 따라 고정 IP 주소를 만듭니다.
방금 예약한 외부 IP를 가져옵니다.
런타임 Istio 인그레스 엔드포인트의 레코드 집합을 만듭니다. 이 주소는 하이브리드 게이트웨이에 대해 API 호출을 수행하기 위해 사용됩니다. 이전 단계에서 가져온 외부 IP를 입력하고 도메인 이름에 프리픽스를 추가합니다(예: example-endpoint). 자세한 내용은 새 레코드 만들기를 참조하세요.
네트워크 서비스 Cloud DNS 페이지에서 복사한 도메인 이름 서버를 입력합니다. 예를 들면 다음과 같습니다.
이제 Google Cloud DNS가 도메인의 DNS 레코드를 관리합니다.
VM에 Certbot 설치
도메인 서버를 관리하도록 Cloud DNS를 설정했으므로 이제 Cloud VM에서 dns_google 플러그인을 사용하여 Certbot 클라이언트를 설치합니다. 클라이언트를 사용 설정하면 Let's Encrypt 엔드포인트에서 도메인에 대해 승인된 인증서를 가져올 수 있습니다.
...
envs:
- name: test
serviceAccountPaths:
synchronizer: "your_keypath/synchronizer-manager-service-account.json
udca: "your_keypath/analytic-agent-service-account.json
virtualhosts:
- name: my-env-group
tlsMode: SIMPLE # Note: SIMPLE is the default, MUTUAL is also an available value.
sslSecret: myorg-test-policy-secret"
...
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[[["\u003cp\u003eThis document guides users through obtaining a TLS certificate from Let's Encrypt using the Certbot client and Google Cloud DNS, primarily as an example for those who need an alternative method for getting a CA-authorized certificate.\u003c/p\u003e\n"],["\u003cp\u003eA registered domain name is required, and the guide outlines how to configure Google Cloud DNS to manage DNS records and obtain a qualified domain name.\u003c/p\u003e\n"],["\u003cp\u003eThe process includes setting up a static IP address, creating a DNS record set for the Istio ingress endpoint, and installing the Certbot client with the dns_google plugin on a VM to generate the certificates.\u003c/p\u003e\n"],["\u003cp\u003eAfter generating the certificate and key files, users can store them as a file path in the overrides or create a Kubernetes secret for secure deployment, updating the overrides file accordingly.\u003c/p\u003e\n"],["\u003cp\u003eThe document provides steps to test the configuration by deploying and testing an API proxy after applying the changes to the environment's configuration.\u003c/p\u003e\n"]]],[],null,["# Obtain TLS certificates: An example\n\n| You are currently viewing version 1.13 of the Apigee hybrid documentation. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic is intended as an example only. It explains how to obtain a TLS certificate from\nthe certificate authority (CA) [Let's Encrypt](https://letsencrypt.org).\nThese steps are provided primarily as an example to follow if you do not have\nanother ready way to obtain a certificate/key\npair that is authorized by a CA. The example shows how to generate certificates\nusing the [Let's Encrypt](https://letsencrypt.org) CA, the\n[Certbot client](https://certbot.eff.org/pages/about), and Google Cloud Platform [Cloud DNS](https://cloud.google.com/dns/docs/).\n| **Note:** See also this [Apigee Community article](https://community.apigee.com/articles/86322/free-trusted-ssl-certificates-for-apigee-hybrid-in.html) on using Let's Encrypt with Apigee hybrid.\n\nWhere you can use these certificates\n------------------------------------\n\n\nYou must provide TLS certificates for Runtime ingress gateways exposed outside the cluster.\n| **Note:** In a test or eval environment, you can use a self-signed certificate/key pair or authorized TLS certificates. However, in a production environment, you will need to use signed certificates. You can use either a certificate/key pair or a Kubernetes secret.\nSee also [External connections](/apigee/docs/hybrid/v1.13/ports#external).\n\nRequirements\n------------\n\nYou will need a domain name obtained through a domain name registrar. You can register a domain name through\nGoogle Domains or another domain registrar of your choice.\n\nConfigure Cloud DNS\n-------------------\n\nTo obtain authorized TLS certificates, you must have a qualified domain name. The following steps explain how to use [Google Cloud DNS](https://cloud.google.com/dns/) to obtain a domain name and manage your domain servers.\n\n1. Open the [Google Cloud console](https://console.cloud.google.com) and log into your account.\n2. Select the project where Apigee hybrid is installed.\n3. If you have not already done so, enable the **Cloud DNS API** . See [Enabling APIs](https://cloud.google.com/apis/docs/getting-started#enabling_apis).\n4. Create a static IP address:\n - If you are on GKE, follow the instructions in [Configure static external IP addresses](/compute/docs/ip-addresses/configure-static-external-ip-address) to create a static IP addresses that external processes can use to communicate with the hybrid runtime ingress. You can give the address any name you wish, for example: `apigee-hybrid-runtime`. When you finish, you will use the IP number in the cluster configuration in the next step. For example: `34.66.75.196`\n - If you are on Google Distributed Cloud, follow instructions in the [Plan IP addresses](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/plan-ip-addresses) and [Create a user cluster](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/create-user-cluster) to create a static IP address.\n5. Get the External IP you just reserved.\n6. Create a record set for the runtime Istio ingress endpoint. This is the address for making API calls to the hybrid gateway. Enter the External IP you obtained in the previous step and add a prefix to the domain name, such as `example-endpoint`. For instructions, see [Create a new record](https://cloud.google.com/dns/docs/set-up-dns-records-domain-name#create_a_new_record).\n 1. Create a managed public zone. For instructions, see [Create a managed public zone](https://cloud.google.com/dns/docs/set-up-dns-records-domain-name#create_a_managed_public_zone).\n 2. Create a new record set with:\n - **DNS Name** : The name of the endpoint external API calls will communicate with, like `\n api-services` or `example-endpoint`\n - **Resource Record Type** : **A**\n - **TTL** and **TTL Unit**: Accept defaults\n - **IP Address**: The static IP you created.\n7. The **Zone details** view will list four DNS servers as the NS data for your new zone. Copy the DNS record data, as shown in the following example:\n\n8. Return to your domain page at your registrar (for example, [Google\n Domains](https://domains.google.com)).\n9. Select your domain.\n10. Select **DNS**.\n11. In the Name Servers section, click **Edit**.\n12. Enter the domain name servers that you copied from the Network Services Cloud DNS\n page. For example:\n\n\nNow, your Google Cloud DNS will manage the DNS records for your domain.\n\nInstall Certbot on a VM\n-----------------------\n\n\nNow that you have Cloud DNS set up to manage your domain servers, you will install the\nCertbot client with the\n[dns_google](https://certbot-dns-google.readthedocs.io/en/stable/) plugin on a Cloud VM. The client enables\nyou to get authorized certificates for your domain from a Let's Encrypt endpoint.\n\n1. Open the [Google Cloud console](https://console.cloud.google.com) and log in with the account you created in [Step 1: Create a Google Cloud account](/apigee/docs/hybrid/v1.13/precog-gcpaccount).\n2. Select the project that you created in [Step 2: Create a Google Cloud project](/apigee/docs/hybrid/v1.13/precog-gcpproject).\n3. Select **IAM \\& admin \\\u003e Service accounts** .\n\n The **Service accounts view** displays a list of the project's service accounts.\n4. To create a new service account, click **+Create Service Account** at the top of the view.\n\n The **Service account details** view displays.\n5. In the **Service account name** field, enter the name of the service account.\n\n You can optionally add a description in the **Service account description**\n field. Descriptions are helpful at reminding you what a particular service account is used\n for.\n6. Click **Create** .\n\n Google Cloud creates a new service account and displays the **Service account\n permissions** view. Use this view to assign a role to your new service account.\n7. Click the **Select a role** drop-down list.\n8. Select the **Project Owner** role.\n9. Click **Continue**.\n10. Click **Done**.\n11. In the Google Cloud console, select **Compute Engine \\\u003e VM Instances**.\n12. Create a VM instance named **certmanager**.\n13. Under the Boot Disk section, choose CentOS7 and 20 GB for the SSD persistent drive.\n14. Set the Service Account to the one you created above.\n15. Install Certbot and the [dns_google](https://certbot-dns-google.readthedocs.io/en/stable/) plugin on the machine and run the Certbot client: \n\n sudo su -\n yum -y install yum-utils\n yum install certbot -y\n yum install certbot-dns-google -y\n certbot certonly --dns-google -d *.\u003cvar translate=\"no\"\u003eyour_domain_name\u003c/var\u003e,*.\u003cvar translate=\"no\"\u003eyour_domain_name\u003c/var\u003e --server https://acme-v02.api.letsencrypt.org/directory\n \n\n For example: \n\n sudo su -\n yum -y install yum-utils\n yum install certbot -y\n yum install certbot-dns-google -y\n certbot certonly --dns-google -d *.apigee-hybrid-docs.net,*.apigee-hybrid-docs.net --server https://acme-v02.api.letsencrypt.org/directory\n\n16. You can now find your authorized certificate and private key files in this directory: `cd /etc/letsencrypt/live/`\u003cvar translate=\"no\"\u003eyour_domain_name\u003c/var\u003e`/`\n\n\n For example: \n\n cd /etc/letsencrypt/live/apigee-hybrid-docs.net\n ls\n cert.pem chain.pem fullchain.pem privkey.key README\n\n17. Copy the files `fullchain.pem` and `privkey.key` to your local machine.\n18. *Optional* : Create a Kubernetes secret with the certificate/key pair. See the instructions in [Option 2: Kubernetes Secret](/apigee/docs/hybrid/v1.13/ingress-tls#option-2:-kubernetes-secret) in [Configuring TLS and mTLS on the Istio ingress](/apigee/docs/hybrid/v1.13/ingress-tls).\n19. Update your overrides file to point to the certificate and private key.\n For example:\n\n ```scdoc\n ...\n envs:\n - name: test\n serviceAccountPaths:\n synchronizer: \"your_keypath/synchronizer-manager-service-account.json\n udca: \"your_keypath/analytic-agent-service-account.json\n\n virtualhosts:\n - name: my-env-group\n sslCertPath: \"$HOME/hybrid/apigee-hybrid-setup/tls/fullchain.pem\"\n sslKeyPath: \"$HOME/hybrid/apigee-hybrid-setup/tls/privkey.key\"\n ```\n\n\n Or if using Kubernetes secrets: \n\n ```scdoc\n ...\n envs:\n - name: test\n serviceAccountPaths:\n synchronizer: \"your_keypath/synchronizer-manager-service-account.json\n udca: \"your_keypath/analytic-agent-service-account.json\n\n virtualhosts:\n - name: my-env-group\n tlsMode: SIMPLE # Note: SIMPLE is the default, MUTUAL is also an available value.\n sslSecret: myorg-test-policy-secret\"\n\n ... \n ```\n20. Apply changes to the `envs` configuration:\n\n Run helm upgrade for each environment you want to update. \n\n ```\n helm upgrade ENV_NAME apigee-env/ \\\n --namespace apigee \\\n --set env=ENV_NAME \\\n --atomic \\\n -f OVERRIDES_FILE.yaml\n ```\n | **Note:** If you see an error saying `Error: UPGRADE FAILED: \"`*ENV_NAME*`\" has no deployed releases`, replace `upgrade` with `install` and try the command again.\n\nTest the configuration\n----------------------\n\n21. Deploy and test a proxy. See [Build your first API proxy overview](/apigee/docs/api-platform/get-started/get-started)."]]
