Deploy a global Google-managed certificate with Certificate Authority Service

Configure CA Service integration with Certificate Manager

To integrate CA Service with Certificate Manager, follow these steps:

1. In the target Google Cloud project, create a Certificate Manager service account:

   gcloud beta services identity create --service=certificatemanager.googleapis.com \
       --project= PROJECT_ID 
   

   Replace PROJECT_ID with the ID of the target Google Cloud project.

   The command returns the name of the created service identity. See the following example:

   service-520498234@gcp-sa-certificatemanager.iam.gserviceaccount.com

2. Grant the Certificate Manager service account the CA Service Certificate Requester role ( roles/privateca.certificateRequester ) within the target CA pool:

   gcloud privateca pools add-iam-policy-binding CA_POOL 
   \
       --location LOCATION 
   \
       --member "serviceAccount: SERVICE_ACCOUNT 
   " \
       --role roles/privateca.certificateRequester

   Replace the following:

   • CA_POOL : the ID of the target CA pool.
   • LOCATION : the target Google Cloud location.
   • SERVICE_ACCOUNT : the full name of the service account you created in step 1.

3. Create a certificate issuance configuration resource for your CA pool:

   Console

   1. In the Google Cloud console, go to the Issuance configstab on the Certificate Managerpage.

      Go to Certificate Manager

   2. Click Create. The Create a Certificate Issuance Configpage appears.

   3. In the Namefield, enter a unique name for the certificate issuance configuration.

   4. Optional: In the Descriptionfield, enter a description for the issuance configuration.

   5. For Location, select Global.

   6. Optional: In the Lifetimefield, specify the lifetime of issued certificate in days. The value must be between 21 to 30 days (inclusive).

   7. Optional: In the Rotation window percentage, specify the percentage of the certificate's lifetime when its renewal process begins. To find the range of valid values, see Lifetime and Rotation window percentage .

   8. Optional: From the Key algorithmlist, select the key algorithm to use when generating the private key.

   9. From the CA poollist, select the name of the CA pool to assign to this certificate issuance configuration resource.

   10. In the Labelsfield, specify labels to associate to the certificate. To add a label, click add_box Add label, and specify a key and a value for your label.

   11. Click Create.

   gcloud

   gcloud certificate-manager issuance-configs create ISSUANCE_CONFIG_NAME 
   \
       --ca-pool= CA_POOL 
   

   Replace the following:

   • ISSUANCE_CONFIG_NAME : the name of the certificate issuance configuration resource.
   • CA_POOL : the full resource path and name of the CA pool that you want to assign to this certificate issuance configuration resource.

   For more information about certificate issuance configuration resources, see Manage certificate issuance configuration resources .

Create a Google-managed certificate issued by your CA Service instance

To create a Google-managed certificate issued by your CA Service instance, do the following:

gcloud certificate-manager certificates create CERTIFICATE_NAME 
\
    --domains=" DOMAIN_NAMES 
" \
    --issuance-config= ISSUANCE_CONFIG_NAME 

POST /v1/projects/ PROJECT_ID 
/locations/global/certificates?certificate_id= CERTIFICATE_NAME 
"
{
 "managed": {
  "domains": [" DOMAIN_NAME 
"],
  "issuanceConfig": " ISSUANCE_CONFIG_NAME 
",
 }
}

Verify the status of the certificate

Before deploying a certificate to a load balancer, verify that it's active. It can take several minutes for the certificate state to change to ACTIVE .

gcloud certificate-manager certificates describe CERTIFICATE_NAME 

createTime: '2021-10-20T12:19:53.370778666Z'
expireTime: '2022-05-07T05:03:49Z'
managed:
  domains:
  - myorg.example.com
  issuanceConfig: projects/myproject/locations/global/issuanceConfigs/myissuanceConfig
  state: ACTIVE
name: projects/myproject/locations/global/certificates/mycertificate
pemCertificate: |
  -----BEGIN CERTIFICATE-----
  [...]
  -----END CERTIFICATE-----
sanDnsnames:
  - myorg.example.com
updateTime: '2021-10-20T12:19:55.083385630Z'

For more troubleshooting steps, see Troubleshoot Certificate Manager .

Deploy the certificate to a load balancer

To deploy the global Google-managed certificate, use a certificate map.

Create a certificate map

Create a certificate map that references the certificate map entry associated with your certificate:

gcloud certificate-manager maps create CERTIFICATE_MAP_NAME 

 resource "google_certificate_manager_certificate_map" "certificate_map" {
  name        = "${local.name}-certmap-${random_id.tf_prefix.hex}"
  description = "${local.domain} certificate map"
  labels = {
    "terraform" : true
  }
} 

Create a certificate map entry

Create a certificate map entry and associate it with your certificate and certificate map:

gcloud certificate-manager maps entries create CERTIFICATE_MAP_ENTRY_NAME 
\
    --map=" CERTIFICATE_MAP_NAME 
" \
    --certificates=" CERTIFICATE_NAME 
" \
    --hostname=" HOSTNAME 
"

 resource "google_certificate_manager_certificate_map_entry" "first_entry" {
  name        = "${local.name}-first-entry-${random_id.tf_prefix.hex}"
  description = "example certificate map entry"
  map         = google_certificate_manager_certificate_map.certificate_map.name
  labels = {
    "terraform" : true
  }
  certificates = [google_certificate_manager_certificate.root_cert.id]
  hostname     = local.domain
} 

 resource "google_certificate_manager_certificate_map_entry" "second_entry" {
  name        = "${local.name}-second-entity-${random_id.tf_prefix.hex}"
  description = "example certificate map entry"
  map         = google_certificate_manager_certificate_map.certificate_map.name
  labels = {
    "terraform" : true
  }
  certificates = [google_certificate_manager_certificate.root_cert.id]
  hostname     = "*.${local.domain}"
} 

Verify that the certificate map entry is active

Verify that the certificate map entry is active before attaching its corresponding certificate map to the target proxy.

To verify the certificate map entry, use the gcloud certificate-manager maps entries describe command :

gcloud certificate-manager maps entries describe CERTIFICATE_MAP_ENTRY_NAME 
\
    --map=" CERTIFICATE_MAP_NAME 
"

Replace the following:

• CERTIFICATE_MAP_ENTRY_NAME : the name of the certificate map entry.
• CERTIFICATE_NAME : the name of the certificate you want to associate with the certificate map entry.

The output is similar to the following:

certificates:
createTime: '2021-09-06T10:01:56.229472109Z'
hostname: example.com
name: projects/my-project/locations/global/certificateMaps/myCertMap/certificateMapEntries/myCertMapEntry
state: ACTIVE
updateTime: '2021-09-06T10:01:58.277031787Z'

Attach the certificate map to the target proxy

You can attach the certificate map to a new target proxy or an existing target proxy.

gcloud compute target-https-proxies create PROXY_NAME 
\
    --certificate-map=" CERTIFICATE_MAP_NAME 
" \
    --url-map=" URL_MAP 
" \
    --global

gcloud compute target-https-proxies update PROXY_NAME 
\
    --certificate-map=" CERTIFICATE_MAP_NAME 
" \
    --global

gcloud compute target-https-proxies list

When configuring a target proxy, if you attach TLS (SSL) certificates directly and also through a certificate map, the proxy uses the certificates referenced by the certificate map and ignores the directly attached TLS (SSL) certificates.

Troubleshooting certificates issued by CA Service

For troubleshooting steps, see Problems related to certificates issued by a CA Service instance .

Clean up

To avoid incurring charges to your Google Cloud account for the resources used in this tutorial, delete them.

1. Delete the load balancer and its resources.

   See Clean up a load balancing setup .

2. Delete or detach the certificate map from the proxy.

   To delete the certificate map, run the following command:

   gcloud compute target-https-proxies delete PROXY_NAME 
   

   If you want to keep the target HTTPS proxy, then detach the certificate map from the proxy. Before you detach the certificate map, note the following:

   • If there are any TLS (SSL) certificates attached directly to the proxy, detaching the certificate map causes the proxy to resume using those directly attached TLS (SSL) certificates.
   • If there are no TLS (SSL) certificates attached directly to the proxy, the certificate map can't be detached from the proxy. You must first attach at least one TLS (SSL) certificate directly to the proxy before you can detach the certificate map.

   To detach the certificate map, run the following command:

   gcloud compute target-https-proxies update PROXY_NAME 
   \
       --clear-certificate-map

   Replace PROXY_NAME with the name of the target proxy.

3. Delete the certificate map entry from the certificate map:

   gcloud certificate-manager maps entries delete CERTIFICATE_MAP_ENTRY_NAME 
   \
       --map=" CERTIFICATE_MAP_NAME 
   "

   Replace the following:

   • CERTIFICATE_MAP_ENTRY_NAME : the name of the certificate map entry.
   • CERTIFICATE_MAP_NAME : the name of the certificate map.

4. Delete the certificate map:

   gcloud certificate-manager maps delete CERTIFICATE_MAP_NAME 
   

   Replace CERTIFICATE_MAP_NAME with the name of the certificate map.

5. Delete the Google-managed certificate:

   Console

   1. In the Google Cloud console, go to the Certificate Managerpage.

      Go to Certificate Manager

   2. On the Certificatestab, select the checkbox of the certificate.

   3. Click Delete.

   4. In the dialog that appears, click Deleteto confirm.

   gcloud

   gcloud certificate-manager certificates delete CERTIFICATE_NAME 
   

   Replace CERTIFICATE_NAME with the name of the target certificate.

6. Delete the certificate issuance configuration resource:

   Console

   1. In the Google Cloud console, go to the Issuance configstab on the Certificate Managerpage.

      Go to Certificate Manager

   2. Select the checkbox of the issuance configuration resource that you want to delete.

   3. Click Delete.

   4. In the dialog that appears, click Deleteto confirm.

   gcloud

   gcloud certificate-manager issuance-configs delete ISSUANCE_CONFIG_NAME 
   

   Replace ISSUANCE_CONFIG_NAME with the name of the target certificate issuance configuration resource.

7. Delete the CA pool.

   To delete the CA pool, or to disable the last enabled CA in a CA pool referenced by a certificate issuance configuration resource, delete all certificate issuance configuration resources that reference the CA pool. For more information, see Delete a CA pool .