Troubleshooting SSL certificates

The troubleshooting procedures differ, depending whether you're using Google-managed SSL certificates or self-managed SSL certificates.

Troubleshooting Google-managed certificates

Google-managed SSL certificate status

To check the certificate status, run the following command:

gcloud beta compute ssl-certificates describe certificate-name \
    --global \
    --format="get(name,managed.status)"

Values for managed status are as follows:

Managed status Explanation
PROVISIONING The Google-managed certificate has been created and Google Cloud is working with the Certificate Authority to sign it.
Provisioning a Google-managed certificate might take up to 60 minutes.

If the certificate remains in the PROVISIONING state, make sure that the correct certificate is associated with the target proxy. You can check this by running the gcloud compute target-https-proxies describe or gcloud compute target-ssl-proxies describe command.
ACTIVE The Google-managed SSL certificate is obtained from the Certificate Authority. It might take an additional 30 minutes to be available for use by a load balancer.
PROVISIONING_FAILED You might briefly see PROVISIONING_FAILED even when your certificate is actually ACTIVE. Recheck the status. If the status remains PROVISIONING_FAILED:

The Google-managed certificate has been created, but the Certificate Authority can't sign it. Ensure that you completed all steps in Using Google-managed SSL certificates. Google Cloud retries provisioning until successful or the status changes to PROVISIONING_FAILED_PERMANENTLY.
PROVISIONING_FAILED_PERMANENTLY The Google-managed certificate is created, but the Certificate Authority can't sign it because of a DNS or load balancer configuration issue. In this state, Google Cloud doesn't retry privisioning.

Create a replacement Google-managed SSL certificate, and make sure that the replacement is associated with your load balancer's target proxy. Verify or complete all steps in Using Google-managed SSL certificates. Afterwards, you can delete the certificate that permanently failed provisioning.

Google-managed SSL certificate domain status

To check the domain status, run the following command:

gcloud beta compute ssl-certificates describe certificate-name \
    --global \
    --format="get(managed.domainStatus)"

Values for domain status are described in this table.

Domain status Explanation
PROVISIONING The Google-managed certificate is created for the domain. Google Cloud is working with the Certificate Authority to sign the certificate.
Provisioning a Google-managed certificate might take up to 60 minutes.
ACTIVE The Google-managed SSL certificate is obtained from the Certificate Authority. Provisioning for this domain is complete. It might take an additional 30 minutes for the certificate to be available for use by a load balancer.
FAILED_NOT_VISIBLE Certificate provisioning failed for the domain. Either of the following might be the issue: Google Cloud continues to try to provision the certificate while the managed status is PROVISIONING.
FAILED_CAA_CHECKING Certificate provisioning failed because of a configuration issue with your domain's CAA record. Ensure that you have completed all steps in Using Google-managed SSL certificates.
FAILED_CAA_FORBIDDEN Certificate provisioning failed because your domain's CAA record doesn't specify a CA that Google Cloud needs to use. Ensure that you have completed all steps in Using Google-managed SSL certificates.
FAILED_RATE_LIMITED Certificate provisioning failed because a Certificate Authority has rate-limited certificate signing requests. You can retry Create a replacement Google-managed SSL certificate, or you can contact Google Cloud Support.

Troubleshooting self-managed SSL certificates

Certificate cannot be parsed

Google Cloud requires certificates in PEM format. If the certificate is PEM formatted, check the following:

You can validate your certificate using the following OpenSSL command, replacing certificate-file with the path to your certificate file:

openssl x509 -in certificate-file -text -noout

If OpenSSL is unable to parse your certificate:

Missing common name or subject alternative name

Google Cloud requires that your certificate have either a common name (CN) or subject alternative name (SAN) attribute. See Create a CSR for additional information.

When both attributes are absent, Google Cloud displays an error message like the following when you try to create a self-managed certificate:

ERROR: (gcloud.compute.ssl-certificates.create) Could not fetch resource:
 - The SSL certificate is missing a Common Name(CN) or Subject Alternative
   Name(SAN).

Private key cannot be parsed

Google Cloud requires PEM-formatted private keys that meet the private key criteria.

You can validate your private key using the following OpenSSL command, replacing private-key-file with the path to your private key:

    openssl rsa -in private-key-file -check

The following responses indicate a problem with your private key:

  • unable to load Private Key
  • Expecting: ANY PRIVATE KEY
  • RSA key error: n does not equal p q
  • RSA key error: d e not congruent to 1
  • RSA key error: dmp1 not congruent to d
  • RSA key error: dmq1 not congruent to d
  • RSA key error: iqmp not inverse of q

To fix the problem, you must create a new private key and certificate.

Private keys with passphrases

If OpenSSL prompts for a passphrase, you'll need to remove the passphrase from your private key before you can use it with Google Cloud. You can use the following OpenSSL command:

openssl rsa -in private-key-file \
    -out replacement-private-key-file

Replace the placeholders with valid values:

  • private-key-file: The path to your private key that's protected with a passphrase
  • replacement-private-key-file: A file path where you'd like to save a copy of your plaintext private key

Expiring intermediate certificate(s)

If an intermediate certificate expires before the server (leaf) certificate, this might indicate that your CA isn't following best practices.

When an intermediate certificate expires, your leaf certificate used in Google Cloud might become invalid. This depends on the SSL client, as follows:

  • Some SSL clients only look at the expire time of the leaf certificate and ignore expired intermediate certificates.
  • Some SSL clients treat a chain with any expired intermediate certificate(s) as invalid and display a warning.

To resolve this issue:

  1. Wait for the CA to switch to a new intermediate certificate.
  2. Request a new certificate from them.
  3. Re-upload the new certificate with the new keys.

Your CA might also allow cross-signing for intermediate certificates. Check with your CA to confirm.

RSA public exponent is too large

The following error message appears when the RSA public exponent is larger than 65537. Make sure to use 65537, as specified in RFC 4871.

ERROR: (gcloud.compute.ssl-certificates.create) Could not fetch resource:
 - The RSA public exponent is too large.