Deploy a cross-region self-managed certificate

This tutorial shows you how to use Certificate Manager to deploy a global self-managed certificate to a cross-region internal Application Load Balancer.

If you want to deploy to global external load balancers or regional load balancers, see the following:

Upload a self-managed certificate to Certificate Manager

To upload the certificate to Certificate Manager, do the following:

Console

  1. In the Google Cloud console, go to the Certificate Manager page.

    Go to Certificate Manager

  2. On the Certificates tab, click Add Certificate.

  3. In the Certificate name field, enter a unique name for the certificate.

  4. Optional: In the Description field, enter a description for the certificate. The description lets you identify the certificate.

  5. For Location, select Global.

  6. For Scope, select All regions.

  7. For Certificate type, select Create self-managed certificate.

  8. For the Certificate field, do either of the following:

    • Click the Upload button and select your PEM-formatted certificate file.
    • Copy and paste the contents of a PEM-formatted certificate. The contents must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

  9. For the Private key certificate field, do either of the following:

    • Click the Upload button and select your private key. Your private key must be PEM-formatted and not protected with a passphrase.
    • Copy and paste the contents of a PEM-formatted private key. The private keys must start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----.

  10. In the Labels field, specify labels to associate with the certificate. To add a label, click Add label, and specify a key and a value for your label.

  11. Click Create.

    The new certificate appears in the list of certificates.

gcloud

To create a cross-region self-managed certificate, use the certificate-manager certificates create command:

gcloud certificate-manager certificates create CERTIFICATE_NAME \
    --certificate-file="CERTIFICATE_FILE" \
    --private-key-file="PRIVATE_KEY_FILE" \
    --scope=all-regions

Replace the following:

  • CERTIFICATE_NAME: the name of the certificate.
  • CERTIFICATE_FILE: the path and filename of the CRT certificate file.
  • PRIVATE_KEY_FILE: the path and filename of the KEY private key file.

Terraform

To upload a self-managed certificate, you can use a google_certificate_manager_certificate resource with the self_managed block.

API

Upload the certificate by making a POST request to the certificates.create method as follows:

POST /v1/projects/PROJECT_ID/locations/global/certificates?certificate_id=CERTIFICATE_NAME
{
  self_managed: {
    pem_certificate: "PEM_CERTIFICATE",
    pem_private_key: "PEM_KEY",
    scope: "ALL_REGIONS"
  }
}

Replace the following:

  • PROJECT_ID: the ID of the Google Cloud project.
  • CERTIFICATE_NAME: the name of the certificate.
  • PEM_CERTIFICATE: the certificate PEM.
  • PEM_KEY: the key PEM.

Deploy the self-managed certificate to a load balancer

To deploy the global self-managed certificate, attach it directly to the target proxy.

Attach the certificate directly to the target proxy

You can attach the certificate to a new target proxy or an existing target proxy.

To attach the certificate to a new target proxy, use the gcloud compute target-https-proxies create command:

gcloud compute target-https-proxies create PROXY_NAME \
    --url-map=URL_MAP \
    --certificate-manager-certificates=CERTIFICATE_NAME \
    --global

Replace the following:

  • PROXY_NAME: the name of the target proxy.
  • URL_MAP: the name of the URL map. You created the URL map when you created the load balancer.
  • CERTIFICATE_NAME: the name of the certificate.

To attach the certificate to an existing target HTTPS proxy, use the gcloud compute target-https-proxies update command. If you don't know the name of the existing target proxy, go to the Target proxies page and note the name of the target proxy.

gcloud compute target-https-proxies update PROXY_NAME \
    --global \
    --certificate-manager-certificates=CERTIFICATE_NAME

After creating or updating the target proxy, run the following command to verify it:

gcloud compute target-https-proxies list

Clean up

To avoid incurring charges to your Google Cloud account for the resources used in this tutorial, delete the uploaded certificate:

gcloud certificate-manager certificates delete CERTIFICATE_NAME

Replace CERTIFICATE_NAME with the name of the target certificate.

If you don't plan to use the load balancer, delete the load balancer and its resources. See Clean up a load balancing setup.