Skip to content

Provision certificates to a Google Cloud Classic Load Balancer

Provision a certificate from Certificate Manager - SaaS to a load balancer in your Google Cloud project. Certificate Manager - SaaS creates the certificate as a classic SSL certificate resource and attaches it to the target proxy you choose, replacing the earlier version of the same certificate.

Before you begin

  • A Google Cloud Classic Load Balancer machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • The target proxy, already created in the project. It can be a global target HTTPS proxy, a global target SSL proxy, or a regional target HTTPS proxy.

To provision a certificate to a Google Cloud Classic Load Balancer

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, for Certificate Type, choose Compute Engine SSL Certificate (Global) for a global target proxy or Compute Engine SSL Certificate (Regional) for a regional target proxy. The default is Compute Engine SSL Certificate (Global).

  6. In Certificate Name, enter a base name for the certificate resource.

    Certificate Manager - SaaS adapts the name to Google Cloud naming rules. It lowercases the name, replaces each run of characters other than letters and digits with a hyphen, and removes leading and trailing hyphens. If the result doesn't start with a letter, it adds the prefix c-. It then appends a timestamp suffix in the format -YYYYMMDD-HHMMSS in Coordinated Universal Time (UTC), shortening the base name so the full name fits in 63 characters. Each provisioning creates a new certificate resource with a new suffix.

  7. If you chose Compute Engine SSL Certificate (Regional), in Location (region), replace global with the region of the target proxy, for example us-central1.

  8. Under Installation Endpoint, for Proxy Type, choose the type of the target proxy: Global Target HTTPS Proxy, Global Target SSL Proxy, or Regional Target HTTPS Proxy. The default is Global Target HTTPS Proxy. Choose a global proxy type for a global certificate and Regional Target HTTPS Proxy for a regional certificate.
  9. In Proxy Name, enter the name of the target proxy.
  10. If you chose Regional Target HTTPS Proxy, in Proxy Region, replace global with the proxy's region. Enter the same region as in Location (region).
  11. For Certificate Attachment Method, keep Classic SSL Certificates. It's the only option.
  12. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
  13. Click Save. To save and then provision another certificate, click Save & New.

After you save, Certificate Manager - SaaS creates the classic SSL certificate in the project and updates the target proxy's certificate list. Any certificate on the proxy that has the same base name is replaced by the new one, and the proxy's other certificates stay attached. Certificate Manager - SaaS then deletes the replaced certificate. If it can't, for example because another proxy still uses it, the old certificate stays in the project and provisioning still succeeds. An installation appears on the machine's Installations tab. To provision on a schedule instead of right away, set up a machine provisioning schedule.

To check the result in Google Cloud, list the certificates with gcloud compute ssl-certificates list --global (or --regions=REGION for a regional certificate), and then confirm the new name in the proxy's sslCertificates with gcloud compute target-https-proxies describe PROXY_NAME (add --global or --region=REGION) or gcloud compute target-ssl-proxies describe PROXY_NAME.