Set up certificate-based access

Set up certificate-based access

To set up Context-Aware Access with mTLS, which is also known as certificate-based access (CBA), you must create a new CBA access level, enforce the CBA access level, and enable CBA in your client applications.

Before you begin

Ensure that you deploy the Endpoint Verification Google Chrome extension and the Endpoint Verification helper app on all of the devices that require access to Google Cloud resources. These devices become trusted devices to which you can grant access.

CBA for workload or web applications doesn't require Endpoint Verification.

If you need to deploy Endpoint Verification, see Deploy Endpoint Verification to use with certificate-based access.

Set up CBA

To set up CBA, complete the following steps:

1. Create a new CBA access level that requires certificates when determining access to resources.

2. Enforce the CBA access level on a resource by using one of the following methods:

   • Restrict access to VPC Service Controls-supported Google Cloud services by creating a VPC Service Controls perimeter with the CBA access level and then adding services into the perimeter. For detailed instructions, see Enable certificate-based access with VPC Service Controls.

   • Restrict access to all of your Google Cloud services, including the Google Cloud console, by binding the CBA access level to a user group that you want to restrict access to. For detailed instructions, see Enable certificate-based access with user groups.

   • Restrict access to your VM. For detailed instructions, see Enable certificate-based access for VMs.

   • Restrict access to your web applications. For detailed instructions, see Enable certificate-based access for web applications.

   • Restrict access to all of your Google Cloud services from workloads. For detailed instructions, see Configure certificate-based access for Workload Identity Federation.

3. After you enforce CBA, Context-Aware Access denies access to resources without client certificates. To grant access to trusted devices, ensure that your clients send certificates to Google APIs through an mTLS connection by enabling CBA in your CBA-compatible client. For instructions, see Enable certificate-based access in client applications.

What's next

• Learn about Securing resources with certificate-based access.