Deploy a Google-managed certificate

This tutorial walks you through the certificate deployment process using a Google-managed certificate with DNS authorization as an example.

Objectives

  • Create a Google-managed certificate with DNS authorization using Certificate Manager.
  • Deploy the certificate to a classic external HTTP(S) load balancer using a target HTTPS proxy.

For more information about the certificate deployment process, see Deployment overview.

Before you begin

  1. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  2. Make sure that you have the following roles to complete the tasks in this tutorial:

    • Certificate Manager Owner
    • Cloud DNS Administrator (if using Cloud DNS as your DNS solution)
    • Compute Load Balancer Admin

    For more information, see the following:

Create a Google-managed certificate with DNS authorization

Complete the steps in this section to create a DNS authorization and a Google-managed certificate that references that DNS authorization.

Create a DNS authorization

Before completing the steps in this section, make sure you have created a public DNS zone.

Create the DNS authorization as follows:

gcloud beta certificate-manager dns-authorizations create AUTHORIZATION_NAME \
    --domain="DOMAIN_NAME"

Replace the following:

  • AUTHORIZATION_NAME is a unique name that describes this DNS authorization.
  • DOMAIN_NAME is the name of the domain for which you are creating this DNS authorization.

This command returns the CNAME record that you must add to your DNS configuration. For example:

`_acme-challenge.www.example.com CNAME 534959-1a8a-40cf-90b6-b1f5f8d22517.2.authorize.certificatemanager.goog`

Add the CNAME record to your DNS configuration

When you create a DNS authorization, the gloud command returns the corresponding CNAME record. You must add this CNAME record to your DNS configuration in the DNS zone of the target domain as follows:

  1. Initiate the DNS record transaction:

    gcloud dns record-sets transaction start --zone="DNS_ZONE_NAME"
    

    Replace the following:

    • DNS_ZONE_NAME is the name of the target DNS zone.
  2. Add the CNAME record to the target DNS zone:

    gcloud dns record-sets transaction add CNAME_RECORD \
       --name="_acme-challenge.DOMAIN_NAME." \
       --ttl="30" \
       --type="CNAME" \
       --zone="DNS_ZONE_NAME"
    

    Replace the following:

    • CNAME_RECORD is the full value of the CNAME record returned by the gcloud command that created the corresponding DNS authorization.
    • DOMAIN_NAME is the name of the target domain. You must include the trailing period after the target domain name.
    • DNS_ZONE_NAME is the name of the target DNS zone.
  3. Execute the DNS record transaction to save your changes:

    gcloud dns record-sets transaction execute --zone="DNS_ZONE_NAME"
    

    Replace DNS_ZONE_NAME with the name of the target DNS zone.

Create a Google-managed certificate referencing the DNS authorization

To create a Google-managed certificate that references the DNS authorization you created in the previous steps, do the following:

gcloud beta certificate-manager certificates create CERTIFICATE_NAME \
    --domains=DOMAIN_NAME --dns-authorizations=AUTHORIZATION_NAME

Replace the following:

  • CERTIFICATE_NAME is a unique name that describes this certificate.
  • DOMAIN_NAME is the target domain for this certificate.
  • AUTHORIZATION_NAME is the name of the DNS authorization you created for this certificate.

Deploy the certificate to a load balancer

Complete the steps in this section to deploy the Google-managed certificate you created in the previous steps to a load balancer.

Create a certificate map

Create a certificate map that references the certificate map entry associated with your certificate:

gcloud beta certificate-manager maps create CERTIFICATE_MAP_NAME

Replace CERTIFICATE_MAP_NAME with the name of the target certificate map.

Create a certificate map entry

Create a certificate map entry and associate it with your certificate as well as your certificate map:

gcloud beta certificate-manager maps entries create CERTIFICATE_MAP_ENTRY_NAME \
    --map="CERTIFICATE_MAP_NAME" \
    --certificates="CERTIFICATE_NAME" \
    --hostname="HOSTNAME"

Replace the following:

  • CERTIFICATE_MAP_ENTRY_NAME is a unique name that describes this certificate map entry.
  • CERTIFICATE_MAP_NAME is the name of the certificate map to which this certificate map entry attaches.
  • CERTIFICATE_NAME is the name of the certificate you want to associate with this certificate map entry.
  • HOSTNAME is the hostname that you want to associate with this certificate map entry.

Verify that the certificate map entry is active

Use the following command to verify that the certificate map entry is active before attaching its corresponding certificate map to the target proxy:

gcloud beta certificate-manager maps entries describe CERTIFICATE_MAP_ENTRY_NAME \
    --map="CERTIFICATE_MAP_NAME"

Replace the following:

  • CERTIFICATE_MAP_ENTRY_NAME is the name of the target certificate map entry.
  • CERTIFICATE_MAP_NAME is the name of the certificate map to which this certificate map entry attaches.

The gcloud tool returns output similar to the following:

 createTime: '2021-09-06T10:01:56.229472109Z'
 name: projects/my-project/locations/global/certificateMaps/myCertMap/certificateMapEntries/myCertMapEntry
 state: ACTIVE
 updateTime: '2021-09-06T10:01:58.277031787Z'

Verify that the certificate is active

Use the following command to verify that the certificate itself is active before attaching its corresponding map entry to the target proxy:

gcloud beta certificate-manager certificates describe CERTIFICATE_NAME

Replace CERTIFICATE_NAME with the name of the target Google-managed certificate.

The gcloud tool returns output similar to the following:

certificatePem: myPEM
createTime: '2021-10-20T12:19:53.370778666Z'
expireTime: '2022-05-07T05:03:49Z'
managed:
  authorizationAttemptInfo:
  - domain: example.com
    state: AUTHORIZED
  dnsAuthorizations:
  - projects/my-project/locations/global/dnsAuthorizations/myAuth
  domains:
  - example.com
  state: ACTIVE
name: projects/myProject/locations/global/certificates/myCert
scope: myScope
sanDnsnames:
- example.com
updateTime: '2021-10-20T12:19:55.083385630Z'

Attach the certificate map to the target proxy

Attach the configured certificate map to the desired target proxy:

  1. In the Cloud console, go to the Target proxies page.

    Go to Target proxies

  2. Note the name of the target proxy.

  3. Attach the certificate map to the target proxy:

    gcloud beta compute target-https-proxies update PROXY_NAME \
       --certificate-map="CERTIFICATE_MAP_NAME"
    

    Replace the following:

    • PROXY_NAME is the name of the target proxy.
    • CERTIFICATE_MAP_NAME is the name of the certificate map referencing your certificate map entry and its associated certificate.

If there are any existing TLS (SSL) certificates attached to the proxy, attaching a certificate map detaches those certificates from the proxy.

Clean up

To revert the changes you have made in this tutorial, complete the following steps:

  1. Detach the certificate map from the proxy:

    gcloud beta compute target-https-proxies update PROXY_NAME \
       --clear-certificate-map
    

    Replace PROXY_NAME with the name of the target proxy.

    If there were any TLS (SSL) certificates attached directly to the proxy before you attached your certificate map, detaching the certificate map reattaches those certificates back to the proxy.

  2. Delete the certificate map entry from the certificate map:

    gcloud beta certificate-manager maps entries delete CERTIFICATE_MAP_ENTRY_NAME \
      --map="CERTIFICATE_MAP_NAME"
    

    Replace the following:

    • CERTIFICATE_MAP_ENTRY_NAME with the name of the target certificate map entry.
    • CERTIFICATE_MAP_NAME with the name of the target certificate map.
  3. Delete the certificate map:

    gcloud beta certificate-manager maps delete CERTIFICATE_MAP_NAME
    

    Replace CERTIFICATE_MAP_NAME with the name of the target certificate map.

  4. Delete the Google-managed certificate:

    gcloud beta certificate-manager certificates delete CERTIFICATE_NAME
    

    Replace CERTIFICATE_NAME with the name of the target certificate.

  5. Delete the DNS authorization:

    gcloud beta certificate-manager dns-authorizations delete AUTHORIZATION_NAME
    

    Replace AUTHORIZATION_NAME with the name of the target DNS authorization.

What's next