Deploy a global self-managed certificate

---

This tutorial describes how to use Certificate Manager to deploy a global self-managed certificate.

The following load balancers support global self-managed certificates:

• Global external Application Load Balancer
• Classic Application Load Balancer
• Global external proxy Network Load Balancer
• Cross-region internal Application Load Balancer

To deploy a self-managed certificate to a regional external Application Load Balancer or to a regional internal Application Load Balancer, see Deploy a regional self-managed certificate.

Objectives

This tutorial shows you how to complete the following tasks:

• Upload a self-managed certificate to Certificate Manager.
• Deploy the certificate to a supported load balancer using a target HTTPS proxy.

For more information about the certificate deployment process, see Deployment overview.

Before you begin

1. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

2. Make sure that you have the following roles to complete the tasks in this tutorial:

   • Certificate Manager Owner: Required to create and manage Certificate Manager resources.
   • Compute Load Balancer Admin or Compute Network Admin: Required to create and manage HTTPS target proxy.

   For more information, see the following:

   • Roles and permissions for Certificate Manager
   • Compute Engine IAM roles and permissions for Compute Engine
   Note: If you aren't assigned the permissions or roles, contact the IAM Administrator who has the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) to grant you the missing roles.

Create the load balancer

Create the load balancer where you want to deploy the certificate.

• To create a global external Application Load Balancer, see Set up a global external Application Load Balancer with VM instance group backends.

• To create a Classic Application Load Balancer, see Set up a Classic Application Load Balancer with a managed instance group backends.

• To create a Global external proxy Network Load Balancer (SSL proxy), see Set up a global external proxy Network Load Balancer (SSL proxy) with VM instance group backends.

• To create a Global external proxy Network Load Balancer (TCP proxy), see Set up a global external proxy Network Load Balancer (TCP proxy) with VM instance group backends.

• To create a Cross-region internal Application Load Balancer, see Set up a Cross-region internal Application Load Balancer with VM instance group backends.

The rest of this tutorial assumes that you have already configured the load balancer's backends, health check, backend service, and URL map. Note the name of the URL map because you need it later in this tutorial.

Create a private key and certificate

To create a private key and a certificate, do the following:

1. Use a trusted third-party certificate authority (CA) to issue the certificate along with its associated key.

2. Verify that the certificate is properly chained and root-trusted.

3. Prepare the following PEM-encoded files:

   • The certificate file (CRT)
   • The corresponding private key file (KEY)

For information about how to request and validate a certificate, see Create a private key and certificate.

Upload a self-managed certificate to Certificate Manager

Console

1. In the Google Cloud console, go to the Certificate Manager page.

   Go to Certificate Manager

2. On the page that appears, select the Certificates tab.

3. Click Add Certificate.

4. Enter a Name for the certificate.

   This name must be unique for the project.

5. Optional: Enter the Description for the certificate. The description helps you identify a specific certificate later.

6. For Location, choose Global.

7. For Scope, choose any of the following options:

   1. Default: Choose default for Global external Application Load Balancer, a Classic Application Load Balancer, or a Global external proxy Network Load Balancer
   2. All-regions: Choose all-regions for a Cross-region internal Application Load Balancer

8. For Certificate type, choose Create Self-managed certificate.

9. For the Certificate field, do any of the following:

   • Click the Upload button and select your PEM-formatted certificate file.
   • Copy and paste the contents of a PEM-formatted certificate. The contents must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

10. For the Private key certificate field, do any of the following:

    • Click the Upload button and select your private key. Your private key must be PEM-formatted and not protected with a passphrase.
    • Copy and paste the contents of a PEM-formatted private key. The private keys must start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----.

11. Specify a label to associate to the certificate. You can add more than one label, if needed. To add a label, click the Add label button, and specify a key and a value for your label.

12. Click Create. Verify that the new certificate appears in the list of certificates.

gcloud

To upload the certificate to Certificate Manager, do the following:

For a Global external Application Load Balancer, a Classic Application Load Balancer, or a Global external proxy Network Load Balancer:

Run the following command:

gcloud certificate-manager certificates create CERTIFICATE_NAME \
   --certificate-file="CERTIFICATE_FILE" \
   --private-key-file="PRIVATE_KEY_FILE"

Replace the following:

• CERTIFICATE_NAME: the unique name of the certificate
• CERTIFICATE_FILE: the path and filename of the CRT certificate file
• PRIVATE_KEY_FILE: the path and filename of the KEY private key file

For a Cross-region internal Application Load Balancer:

Run the following command:

gcloud certificate-manager certificates create CERTIFICATE_NAME \
   --certificate-file="CERTIFICATE_FILE" \
   --private-key-file="PRIVATE_KEY_FILE" \
   --scope=all-regions

Replace the following:

• CERTIFICATE_NAME: the unique name of the certificate
• CERTIFICATE_FILE: the path and filename of the CRT certificate file
• PRIVATE_KEY_FILE: the path and filename of the KEY private key file

Deploy the self-managed certificate to a load balancer

The following sections describe how to deploy the self-managed certificate that you uploaded to Certificate Manager to a load balancer.

Depending on the load balancer type, you can deploy certificates as follows:

• For the following load balancers, deploy the certificate using a certificate map:
  • Global external Application Load Balancer
  • Global external proxy Network Load Balancer
  • Classic Application Load Balancer
• For the Cross-region internal Application Load Balancer, deploy the certificate by attaching it directly to the target proxy.

Deploy the certificate using a certificate map

This section describes the steps to deploy a certificate using a certificate map.

Create a certificate map

Create a certificate map that references the certificate map entry associated with your certificate:

gcloud certificate-manager maps create CERTIFICATE_MAP_NAME

Replace CERTIFICATE_MAP_NAME with the name of the target certificate map.

Create a certificate map entry

Create a certificate map entry, and associate it with your self-managed certificate and certificate map:

gcloud certificate-manager maps entries create CERTIFICATE_MAP_ENTRY_NAME \
    --map="CERTIFICATE_MAP_NAME" \
    --certificates="CERTIFICATE_NAME" \
    --hostname="HOSTNAME"

Replace the following:

• CERTIFICATE_MAP_ENTRY_NAME: a unique name of the certificate map entry
• CERTIFICATE_MAP_NAME: the certificate map name that the certificate map entry is attached to
• CERTIFICATE_NAME: the certificate name that you want to associate with the certificate map entry
• HOSTNAME: the hostname that you want to associate with the certificate map entry

Verify that the certificate map entry is active

Before you attach the certificate map to the target proxy, run the following command to verify whether the certificate map entry is active:

gcloud certificate-manager maps entries describe CERTIFICATE_MAP_ENTRY_NAME \
    --map="CERTIFICATE_MAP_NAME"

Replace the following:

• CERTIFICATE_MAP_ENTRY_NAME: a unique name of the certificate map entry
• CERTIFICATE_MAP_NAME: the certificate map name that the certificate map entry is attached to

If the certificate map entry is active, the Google Cloud CLI returns output similar to the following:

certificates:
createTime: '2021-09-06T10:01:56.229472109Z'
hostname: example.com
name: projects/my-project/locations/global/certificateMaps/myCertMap/certificateMapEntries/myCertMapEntry
state: ACTIVE
updateTime: '2021-09-06T10:01:58.277031787Z'

Create the HTTPS target proxy

To create an HTTPS target proxy, see Create a target proxy.

Attach the certificate map to the target proxy

To attach the configured certificate map to the target proxy, follow these steps:

1. In the Google Cloud console, go to the Target proxies page.

   Go to Target proxies

2. Note the name of the target proxy.

3. To attach the certificate map to the target proxy, run the following command:

   gcloud compute target-https-proxies update PROXY_NAME \
      --certificate-map="CERTIFICATE_MAP_NAME"
   

   Replace the following:

   • PROXY_NAME: the name of the target proxy
   • CERTIFICATE_MAP_NAME: the name of the certificate map that references your certificate map entry and its associated certificate

If any TLS (SSL) certificates are attached directly to the proxy, the proxy gives preference to the certificates referenced by the certificate map over directly attached certificates.

Create a forwarding rule

Set up a forwarding rule and finish setting up the load balancer. For more information, see Use forwarding rules.

Attach the certificate directly to the target proxy

To attach the certificate directly to the proxy, run the following command:

gcloud compute target-https-proxies update PROXY_NAME \
    --url-map=URL_MAP \
    --global \
    --certificate-manager-certificates=CERTIFICATE_NAME

Replace the following:

• PROXY_NAME: a unique name of the proxy.
• URL_MAP: the name of the URL map. You created the URL map when you created the load balancer.
• CERTIFICATE_NAME: the name of the certificate.

Clean up

To revert the changes that you have made in this tutorial, complete the following steps:

1. Detach the certificate map from the proxy:

   gcloud compute target-https-proxies update PROXY_NAME \
      --clear-certificate-map
   

   Replace PROXY_NAME with the name of the target proxy.

   Before you detach the certificate map from the proxy, note the following:

   • Make sure that at least one TLS (SSL) certificate is directly attached to the proxy. If no certificates are attached to the proxy, you can't detach the certificate map.
   • Detaching the certificate map from a proxy enables the proxy to resume using TLS (SSL) certificates that were directly attached to the proxy.

2. Delete the certificate map entry from the certificate map:

   gcloud certificate-manager maps entries delete CERTIFICATE_MAP_ENTRY_NAME \
      --map="CERTIFICATE_MAP_NAME"
   

   Replace the following:

   • CERTIFICATE_MAP_ENTRY_NAME: the name of the target certificate map entry
   • CERTIFICATE_MAP_NAME: the name of the target certificate map

3. Delete the certificate map:

   gcloud certificate-manager maps delete CERTIFICATE_MAP_NAME
   

   Replace CERTIFICATE_MAP_NAME with the name of the target certificate map.

4. Delete the uploaded certificate:

   gcloud certificate-manager certificates delete CERTIFICATE_NAME
   

   Replace CERTIFICATE_NAME with the name of the target certificate.

What's next

• Manage certificates
• Manage certificate maps
• Manage certificate map entries