Set up certificate-based access

To set up Context-Aware Access with mTLS, which is also known as certificate-based access (CBA), you must create a new CBA access level, enforce the CBA access level, and enable CBA in your client applications.

Before you begin

Ensure that the Endpoint Verification Chrome extension and the Endpoint Verification helper app are deployed on all of the devices that require access to Google Cloud resources. These devices become trusted devices to which you can grant access.

CBA for workload or web applications doesn't require Endpoint Verification.

If you need to deploy Endpoint Verification, see Deploying Endpoint Verification to use with certificate-based access.

Set up CBA

To set up CBA, complete the following steps:

  1. Create a new CBA access level that requires certificates when determining access to resources.

  2. Enforce the CBA access level on a resource by using one of the following methods:

  3. After you enforce CBA, access to resources without client certificates is denied. To grant access to trusted devices, you must ensure that your clients are correctly sending certificates to the Google APIs through an mTLS connection. You can do that by enabling the CBA feature in your CBA compatible client using the procedure in Enable certificate-based access in client applications.

What's next