Deploy a regional self-managed certificate

This tutorial shows you how to use Certificate Manager to deploy a self-managed certificate to a regional external Application Load Balancer or to a regional internal Application Load Balancer.

If you want to deploy to global external or cross-region load balancers, see the following:

Upload a self-managed certificate to Certificate Manager

To upload the certificate to Certificate Manager, do the following:

Console

  1. In the Google Cloud console, go to the Certificate Manager page.

    Go to Certificate Manager

  2. On the Certificates tab, click Add Certificate.

  3. In the Certificate name field, enter a unique name for the certificate.

  4. Optional: In the Description field, enter a description for the certificate. The description lets you identify the certificate.

  5. For Location, select Regional.

  6. From the Region list, select your region.

  7. For Certificate type, select Create self-managed certificate.

  8. For the Certificate field, do either of the following:

    • Click the Upload button and select your PEM-formatted certificate file.
    • Copy and paste the contents of a PEM-formatted certificate. The contents must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

  9. For the Private key certificate field, do either of the following:

    • Click the Upload button and select your private key. Your private key must be PEM-formatted and not protected with a passphrase.
    • Copy and paste the contents of a PEM-formatted private key. The private keys must start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----.

  10. In the Labels field, specify labels to associate with the certificate. To add a label, click Add label, and specify a key and a value for your label.

  11. Click Create.

    The new certificate appears in the list of certificates.

gcloud

To create a regional self-managed certificate, run the certificate-manager certificates create command:

gcloud certificate-manager certificates create CERTIFICATE_NAME \
    --certificate-file="CERTIFICATE_FILE" \
    --private-key-file="PRIVATE_KEY_FILE" \
    --location="LOCATION"

Replace the following:

  • CERTIFICATE_NAME: the name of the certificate.
  • CERTIFICATE_FILE: the path and filename of the CRT certificate file.
  • PRIVATE_KEY_FILE: the path and filename of the KEY private key file.
  • LOCATION: the target Google Cloud location.

Terraform

To upload a self-managed certificate, you can use a google_certificate_manager_certificate resource with the self_managed block.

API

Upload the certificate by making a POST request to the certificates.create method as follows:

POST /v1/projects/PROJECT_ID/locations/LOCATION/certificates?certificate_id=CERTIFICATE_NAME
{
  self_managed: {
    pem_certificate: "PEM_CERTIFICATE",
    pem_private_key: "PEM_KEY",
  }
}

Replace the following:

  • PROJECT_ID: the ID of the Google Cloud project.
  • CERTIFICATE_NAME: the name of the certificate.
  • PEM_CERTIFICATE: the certificate PEM.
  • PEM_KEY: the key PEM.
  • LOCATION: the target Google Cloud location.

Deploy the self-managed certificate to a load balancer

To deploy the self-managed certificate, attach it directly to the target proxy.

Attach the certificate directly to the target proxy

You can attach the certificate to a new target proxy or an existing target proxy.

To attach the certificate to a new target proxy, use the gcloud compute target-https-proxies create command:

gcloud compute target-https-proxies create PROXY_NAME \
    --certificate-manager-certificates=CERTIFICATE_NAME \
    --url-map=URL_MAP \
    --region=LOCATION

Replace the following:

  • PROXY_NAME: the name of the target proxy.
  • CERTIFICATE_NAME: the name of the certificate.
  • URL_MAP: the name of the URL map. You created the URL map when you created the load balancer.
  • LOCATION: the target Google Cloud location where you want to create the HTTPS target proxy.

To attach certificate to an existing target HTTPS proxy, use the gcloud compute target-https-proxies update command. If you don't know the name of the existing target proxy, go to the Target proxies page and note the name of the target proxy.

gcloud compute target-https-proxies update PROXY_NAME \
    --region=LOCATION \
    --certificate-manager-certificates=CERTIFICATE_NAME

After creating or updating the target proxy, run the following command to verify it:

gcloud compute target-https-proxies list

Clean up

To avoid incurring charges to your Google Cloud account for the resources used in this tutorial, delete the uploaded certificate:

gcloud certificate-manager certificates delete CERTIFICATE_NAME

Replace CERTIFICATE_NAME with the name of the target certificate.

If you don't plan to use the load balancer, delete the load balancer and its resources. See Clean up a load balancing setup.