Skip to content

Create a Google Cloud Classic Load Balancer machine

Create a Google Cloud Classic Load Balancer machine so Certificate Manager - SaaS can discover and provision the classic SSL certificates on the load balancers in a Google Cloud project. One machine covers the global target HTTPS proxies, global target SSL proxies, and regional target HTTPS proxies in the project.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • The ID of the Google Cloud project that contains the load balancers. It's shown on the project's dashboard in the Google Cloud console.
  • An active VSatellite that can reach the Google Cloud APIs.
  • The Compute Engine API turned on in the project.
  • A Google Cloud service account with these Identity and Access Management (IAM) permissions in the project:
    • For discovery: compute.projects.get, compute.regions.list, compute.targetHttpsProxies.list, compute.targetSslProxies.list, compute.regionTargetHttpsProxies.list, compute.sslCertificates.get, and compute.regionSslCertificates.get.
    • For provisioning, also: compute.sslCertificates.create, compute.sslCertificates.delete, compute.regionSslCertificates.create, compute.regionSslCertificates.delete, compute.targetHttpsProxies.get, compute.targetHttpsProxies.setSslCertificates, compute.targetSslProxies.get, compute.targetSslProxies.setSslCertificates, compute.regionTargetHttpsProxies.get, compute.regionTargetHttpsProxies.setSslCertificates, compute.globalOperations.get, and compute.regionOperations.get.

Note

Certificate Manager - SaaS supports only classic SSL certificates (Compute Engine SSL certificate resources). It doesn't support Certificate Manager certificates or certificate maps.

To create a Google Cloud Classic Load Balancer machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Google Cloud Load Balancer.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. In GCP Project ID, enter the ID of the Google Cloud project.

  8. For Authentication Method, choose how Certificate Manager - SaaS authenticates to Google Cloud:

    • Service Account JSON Key to use a key for the service account. This is the default.
    • Default Credentials (VM Service Account) to use the service account attached to the Compute Engine virtual machine (VM) that hosts the VSatellite. The VM needs the service account attached with the cloud-platform access scope. The VSatellite host also needs network changes so that connector workloads can reach the Google Cloud metadata server.
    • OAuth2 Access Token to use a short-lived access token.

  9. If you chose Service Account JSON Key, in Service Account JSON Key, paste the contents of the service account's JSON key file.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  10. If you chose OAuth2 Access Token, in OAuth2 Access Token, enter the access token.

    Important

    Certificate Manager - SaaS doesn't refresh the token. When it expires, typically after 1 hour, discovery and provisioning fail until you enter a new token.

  11. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Certificate Manager - SaaS can authenticate and read the project. It doesn't confirm the load balancer and certificate permissions that discovery and provisioning need.

  12. (Optional) Leave Certificate Types to Discover and Regions to scan (comma-separated, leave empty for all) empty. These options don't currently limit discovery. Discovery always finds the classic SSL certificates attached to the project's global target HTTPS proxies, global target SSL proxies, and regional target HTTPS proxies in every available region. It doesn't find certificates that aren't attached to a proxy.

  13. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  14. Click Continue. The Provisioning step opens.

  15. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  16. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates on your load balancers.