Your organization is deploying a public web application hosted on a Compute Engine instance group. You have configured a Global External Application Load Balancer and created a Google-managed SSL certificate for your custom domain `app.example.com`. However, after deploying the target HTTPS proxy and forwarding rule, the SSL certificate status remains in `PROVISIONING` and clients cannot establish secure HTTPS connections. What configuration step must be completed to finalize domain ownership verification and successfully provision the managed SSL certificate?
- Create an A or AAAA record in your Cloud DNS public zone that resolves the domain name to the load balancer's external IP address.Answer
- BEnable the Cloud Certificate Manager API in the central VPC host project instead of the service project where the load balancer resides.
- CGrant the Compute Security Admin IAM role at the folder level to override project-level certificate access constraints.
- DReconfigure the load balancer to use a Regional External Application Load Balancer, because Global External Application Load Balancers do not support Google-managed certificates.
Answer
Creating an A or AAAA record in the Cloud DNS public zone that points the domain to the Global External Application Load Balancer's external IP address is required to complete Google-managed SSL certificate provisioning.
For a Google-managed SSL certificate to transition from PROVISIONING to ACTIVE status, Google must verify domain ownership. This is accomplished when an A or AAAA record in Cloud DNS maps the target domain name directly to the external IP address of the Global External Application Load Balancer frontend.
Step-by-Step Solution
Key Concept
Google-Managed SSL Certificate Provisioning and Cloud DNS Routing