이 페이지에서는 Google Kubernetes Engine, Kubernetes 또는 Compute Engine으로 Extensible Service Proxy(ESP)를 배포할 때, 보안 소켓 레이어(SSL) 포트를 어떻게 사용 설정하는지 설명합니다. 일부 사용 사례의 경우 배포된 Endpoints 서비스에 SSL 포트를 사용 설정해야 할 수도 있습니다. 예를 들어 gRPC의 트랜스코딩 기능을 사용하는 경우, 서비스가 동일 포트에서 HTTP 1.1 및 gRPC 요청을 수신하도록 할 수 있습니다.
시작하기 전에 선택한 서비스 유형 및 환경에 대한 가이드를 검토하고 SSL 없이 ESP를 배포하는 방법을 알아두어야 합니다.
SSL 키 및 인증서 구성
HTTPS 요청을 처리하도록 SSL 포트를 구성하려면 다음 단계를 따르세요.
SSL 키 파일 이름이 nginx.key이고 인증서 파일 이름이 nginx.crt인지 확인합니다. 테스트를 위해 다음 명령어로 OpenSSL을 사용하여 자체 서명된 nginx.key와 nginx.cert를 생성할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis document details the process of enabling a Secure Sockets Layer (SSL) port when deploying the Extensible Service Proxy (ESP) with Google Kubernetes Engine, Kubernetes, or Compute Engine.\u003c/p\u003e\n"],["\u003cp\u003eTo enable SSL, you'll need to generate or use existing SSL key and certificate files (named \u003ccode\u003enginx.key\u003c/code\u003e and \u003ccode\u003enginx.crt\u003c/code\u003e), ensuring they include both \u003ccode\u003eCN\u003c/code\u003e and \u003ccode\u003esubjectAltName\u003c/code\u003e attributes matching the service's DNS or IP.\u003c/p\u003e\n"],["\u003cp\u003eFor Kubernetes, create a secret with your SSL key and certificate, modify the configuration file to include volume mounts, and ensure the ESP startup includes the \u003ccode\u003e--ssl_port\u003c/code\u003e flag.\u003c/p\u003e\n"],["\u003cp\u003eFor Compute Engine, copy the \u003ccode\u003enginx.key\u003c/code\u003e and \u003ccode\u003enginx.crt\u003c/code\u003e files to the \u003ccode\u003e/etc/nginx/ssl\u003c/code\u003e directory on your instance, and configure the ESP Docker container to mount the certificate directory and enable SSL via the \u003ccode\u003e--ssl_port=443\u003c/code\u003e flag.\u003c/p\u003e\n"],["\u003cp\u003eRegularly update SSL certificates by creating new ones, mounting them to secrets (Kubernetes) or copying them to the appropriate directory (Compute Engine), and updating the ESP deployment or restarting the container.\u003c/p\u003e\n"]]],[],null,["# Enabling SSL for Cloud Endpoints with ESP\n\nOpenAPI \\| [gRPC](/endpoints/docs/grpc/enabling-ssl \"View this page for the Cloud Endpoints gRPC docs\")\n\n\u003cbr /\u003e\n\nThis page explains how to enable a Secure Sockets Layer (SSL) port when deploying the Extensible Service Proxy\n(ESP) with Google Kubernetes Engine, Kubernetes, or\nCompute Engine. You may want to enable an SSL port for your deployed Endpoints service for some use cases. For example, if you are using gRPC's transcoding feature, you might want your service to receive both HTTP 1.1 and gRPC requests on the same port.\n\nBefore you begin, make sure that you have already reviewed the [tutorials](/endpoints/docs/openapi/tutorials) for your chosen service type and environment, and know how to deploy ESP without\nSSL.\n| **Note:** This tutorial describes how to use *self-managed SSL certificates* with ESP. Google-managed SSL certificates aren't currently supported by ESP.\n\nConfiguring your SSL keys and certificates\n------------------------------------------\n\nTo configure your SSL port to serve HTTPS requests, follow the steps below:\n\n1. Check to ensure that your SSL key file is named `nginx.key` and your certificate file is named `nginx.crt`. For testing, you can generate a self-signed `nginx.key` and\n `nginx.cert` using OpenSSL with the following command:\n\n ```\n openssl req -x509 -nodes -days 365 -newkey rsa:2048 \\\n -keyout ./nginx.key -out ./nginx.crt\n ```\n2. Specify both `CN` and `subjectAltName` in your server certificate. The value of these attributes\n should match the DNS or IP used by clients to call your service; otherwise, the\n SSL handshake will fail.\n\nEnabling SSL for ESP on Kubernetes\n----------------------------------\n\nTo enable the SSL port for ESP on Kubernetes:\n\n1. Create a Kubernetes secret with your SSL key and certificate:\n\n ```\n kubectl create secret generic nginx-ssl \\\n --from-file=./nginx.crt --from-file=./nginx.key\n ```\n2. Edit the Kubernetes configuration files, for example, `esp_echo_gke.yaml`,\n as shown in the following snippet:\n\n template:\n metadata:\n labels:\n app: esp-echo\n spec:\n volumes:\n - name: nginx-ssl\n secret:\n secretName: nginx-ssl\n containers:\n - name: esp\n image: gcr.io/endpoints-release/endpoints-runtime:1\n args: [\n \"--http_port\", \"8080\",\n \"--ssl_port\", \"443\",\n \"--backend\", \"127.0.0.1:8081\",\n \"--service\", \"SERVICE_NAME\",\n \"--rollout_strategy\", \"managed\",\n ]\n ports:\n - containerPort: 8080\n - containerPort: 443\n volumeMounts:\n - mountPath: /etc/nginx/ssl\n name: nginx-ssl\n readOnly: true\n - name: echo\n image: gcr.io/endpoints-release/echo:latest\n ports:\n - containerPort: 8081\n\n\n **Note**: The configuration sample displays the lines that need to be edited. To deploy the file to Cloud Endpoints, the complete configuration file is required.\n3. Mount the Kubernetes secrets you created as volumes, following the\n directions in the [Kubernetes volumes\n page](http://kubernetes.io/docs/user-guide/volumes/).\n\n4. Start up ESP as described in\n [Specifying startup options for ESP](/endpoints/docs/openapi/specify-proxy-startup-options),\n but make sure you add the startup flag `--ssl_port` to enable the SSL port.\n (Note that the default SSL port is 443.)\n\n5. Start the service with the updated Kubernetes configuration file by using `kubectl`.\n\n ```\n kubectl apply -f esp_echo_gke.yaml\n ```\n | **Note:** If you already have an existing [Kubernetes\n | deployment](http://kubernetes.io/docs/user-guide/deployments/), you can [update the deployment](http://kubernetes.io/docs/user-guide/deployments/#updating-a-deployment) directly.\n\n### Update SSL certificates\n\nIt is important to update your SSL certificates periodically.\nTo update your SSL certificates, you must perform the following steps:\n\n- Create new certificates, as described in Step 1 above.\n- Mount the new certificates to the Kubernetes secrets, as described in Step 3 above.\n- Update the ESP Kubernetes deployment, as described in Step 5 above.\n\nEnabling SSL for ESP on Compute Engine\n--------------------------------------\n\nTo enable SSL on Compute Engine, first copy the `nginx.key` and `nginx.crt` files to\nyour Compute Engine instance's `/etc/nginx/ssl` folder, using the following steps:\n\n1. Run the following command and replace \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e\n with the name of your Compute Engine instance:\n\n ```\n gcloud compute scp nginx.* INSTANCE-NAME\n ```\n2. Connect to the instance using `ssh`.\n\n ```\n gcloud compute ssh INSTANCE-NAME\n ```\n3. In the instance VM box, make the directory and copy in the files:\n\n sudo mkdir -p /etc/esp/ssl\n sudo cp server.* /etc/esp/ssl/\n\n4. Follow the instructions for your service type to deploy with Docker. When you\n run the ESP Docker container, use this command:\n\n ```\n sudo docker run --name=esp \\\n --detach \\\n --publish=443:443 \\\n --net=esp_net \\\n --volume=/etc/nginx/ssl:/etc/nginx/ssl \\\n --link=echo:echo \\\n gcr.io/endpoints-release/endpoints-runtime:1 \\\n --service=SERVICE_NAME \\\n --rollout_strategy=managed \\\n --backend=echo:8080 \\\n --ssl_port=443\n ```\n\n As compared to the non-SSL `docker run` command, the SSL version of the\n command creates a different configuration. For example, the SSL command:\n - Mounts the folder with the key and CRT files to the container by using `--volume`\n - Uses `--ssl_port=443` to tell ESP to enable SSL on port `443`.\n - Changes the port mapping flag `--publish`.\n\n### Update SSL certificates\n\nIt is important to update your SSL certificates periodically.\nTo update your SSL certificates, you must perform the following steps:\n\n- Create new certificates and copy them into VM instances, as described in Step 1 above.\n- Copy the new certificates into the `/etc/esp/ssl` directory, as described in Step 3 above.\n- Stop and restart the ESP container using the `sudo docker run` command, as described in Step 4 above.\n\nTesting the SSL port\n--------------------\n\nTo make the testing easier, set the following environment variables:\n\n1. Set \u003cvar translate=\"no\"\u003eIP_ADDRESS\u003c/var\u003e to the IP address of the Compute Engine instance with the new SSL certificate.\n\n | **Note:** The example test commands below assume that the server does not yet have a fully qualified domain name (FQDN) and that \u003cvar translate=\"no\"\u003eIP_ADDRESS\u003c/var\u003e has been used as the FQDN when generating the self-signed certificate. When the server does get an FQDN, use the FQDN to generate the certificate. Then, replace \u003cvar translate=\"no\"\u003eIP_ADDRESS\u003c/var\u003e with the FQDN in the example commands below.\n2. Set \u003cvar translate=\"no\"\u003eENDPOINTS_KEY\u003c/var\u003e to a valid [API key](https://console.cloud.google.com/apis/credentials).\n\nOnce the SSL port is enabled, you can use HTTPS to send requests to the\nExtensible Service Proxy. If your certificate is self-signed, use `-k` to turn on the insecure option in `curl`: \n\n```\ncurl -k -d '{\"message\":\"hello world\"}' -H \"content-type:application/json\" \\\nhttps://IP_ADDRESS:443/echo?key=ENDPOINTS_KEY\n```\n\nAlternatively, generate the certificate in `pem` format and use the `--cacert` option to use the self-signed certificate in `curl`, as shown below: \n\n openssl x509 -in nginx.crt -out nginx.pem -outform PEM\n curl --cacert \"./nginx.pem\" -d '{\"message\":\"hello world\"}' -H \"content-type:application/json\" \\\n https://\u003cvar translate=\"no\"\u003eIP_ADDRESS\u003c/var\u003e:443/echo?key=\u003cvar translate=\"no\"\u003eENDPOINTS_KEY\u003c/var\u003e"]]
