Web TLS certificate configuration

Google Distributed Cloud (GDC) air-gapped appliance provides a public key infrastructure (PKI) API for you to obtain a web certificate. This API supports several user modes:

  • Fully-managed: certificates issued by GDC PKI infrastructure and chained to a GDC-managed self-signed root certificate authority (CA).
  • BYO cert: you provide a pool of certificates with a default wildcard certificate. GDC will use the best matched certificate for your service.
  • BYO SubCA: certificates issued by GDC PKI infrastructure and chained to your SubCA. You must provide the SubCA and let GDC operate it.

Infra PKI mode definitions

This section provides a detailed explanation of each PKI user mode.

Fully Managed mode (default mode)

In fully managed mode, the tenant organization relies on the GDC public key infrastructure (PKI) to issue certificates. When you create a new organization, this mode is the default mode applied. Afterwards, you can switch to a different PKI mode.

With this mode, you must obtain and distribute the root CA to your environment for trust.

PKI Fully Managed mode

BYO Certificates mode

BYO certificate mode supports signing leaf certificates with external or user-managed CAs. This mode generates a certificate signing request (CSR) for every certificate request. While waiting for signing, BYO cert mode searches for an existing customer-signed certificate among the pool that matches with the certificate request:

  • If it can't find a matching certificate, a GDC-managed fallback CA issues a temporary certificate ready for immediate use.
  • If it finds a matching certificate, it uses the matching certificate as the temporary certificate for the current request.

To sign the CSR, you must perform the following steps:

  1. Download the CSR from the Certificate custom resource status.
  2. Upload the signed certificate and the external CA certificate to the same Certificate custom resource with an update to the spec field.

To manage verification and replace the temporary certificate, GDC air-gapped appliance updates the certificate secret with the uploaded certificate and the external CA. You don't have to change your trust stores.

For more information, see Sign the BYO certificate.

PKI BYO Certificates mode

BYO SubCA mode

With BYO SubCA mode, a CSR for the SubCA generates within the GDC air-gapped appliance Management API server. You must sign the CSR request, and upload the signed certificate into the system. For more information, see Sign the BYO SubCA certificate. You can create a CertificateIssuer custom resource that points to this SubCA and mark it as the default CertificateIssuer.

The newly created subCA issues all of the subsequent web certificates. You don't have to change your trust stores.

PKI BYO SubCA mode

Transition to a different PKI mode

The PKI API supports transition from the default fully-managed mode to other supported custom modes. For more information, see transition to different PKI modes.