What Is Certificate Manager?
Certificate Manager is Google Cloud’s service for acquiring, managing, and deploying TLS (SSL) certificates. It supports Cloud Load Balancing, Secure Web Proxy, and Media CDN. Rather than maintaining certificates individually per load balancer, you manage them centrally and associate them with hostnames through certificate maps.
The service offers two certificate types: Google-managed certificates, which Google Cloud obtains, issues, and renews automatically, and self-managed certificates, which you obtain, provision, and renew yourself.
Core Capabilities
- Google-managed certificates with automatic issuance and renewal
- Self-managed certificates for your own or externally obtained certificates
- Certificate maps and entries mapping hostnames to certificates
- DNS authorizations and load balancer authorization as domain validation methods
- Certificate issuance configuration to control certificate generation
- Trust configs for mutual TLS (mTLS)
- Public Certificate Authority for publicly trusted certificates
Typical Use Cases
Large certificate estates: Organizations with many domains manage certificates in one place instead of spreading them across individual load balancer configurations.
Automated renewal: Google-managed certificates are issued and renewed automatically, removing manual renewal windows.
Mutual TLS: Trust configs let you set up mutual TLS authentication between client and load balancer.
Media delivery: Certificates for Media CDN and Secure Web Proxy are deployed globally.
Benefits
- Central management instead of per-load-balancer certificate maintenance
- Automatic renewal of Google-managed certificates
- Two validation methods (DNS authorization and load balancer authorization)
- Support for global and regional load balancer types
- Foundation for mTLS scenarios through trust configs
Working with innFactory
As a certified Google Cloud Partner, innFactory supports you with Certificate Manager:
- Certificate strategy: choosing between Google-managed and self-managed certificates per use case
- Migration: moving existing load balancer certificates into Certificate Manager
- Automation: building DNS authorizations and certificate maps as infrastructure as code
- mTLS architecture: designing and implementing trust configs for mutual TLS authentication
Get in touch for a consultation on Certificate Manager and TLS architectures on Google Cloud.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Certificate Manager?
Certificate Manager acquires, manages, and deploys TLS (SSL) certificates for Cloud Load Balancing, Secure Web Proxy, and Media CDN. It centralizes certificate management instead of handling certificates per load balancer.
What is the difference between Google-managed and self-managed certificates?
Google-managed certificates are certificates that Google Cloud obtains and manages for you, including automatic issuance and renewal. Self-managed certificates are certificates that you obtain, provision, and renew yourself.
How do I prove domain ownership?
Certificate Manager supports DNS authorizations and load balancer authorization as an alternative validation method. Certificates with the "ALL_REGIONS" scope do not support load balancer authorization.
How many domains can one certificate cover?
With DNS authorization, up to 100 domains are supported in the Subject Alternative Names; with load balancer authorization, up to 5. The authoritative figures are in the official documentation.
What are certificate maps for?
Certificate maps and their entries associate certificates with the matching hostnames, controlling which certificate is served for which domain.
What is Certificate Manager (2nd gen)?
In addition to the existing version, Google documents a second generation of Certificate Manager with its own documentation and a feature comparison. Consult the official documentation to determine which variant fits your use case.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
