SSL Certificate for Load Balancer using gcloud

Question

Question: When I use the UI to add a new SSL certificate to a Target HTTPS Proxy, I am expected to enter Certificate, Private Key and Certificate Chain. In the command line, it only asks for Certificate and Private Key. Am I missing something?

GalloCedrone GalloCedrone · Accepted Answer · 2018-03-21T12:50:47

A brief summary on certificates

When you sign a certificate request (scr) basically you are signing a public key together with some useful information that links that public key to the domain, organisation or entity that should be the unique owner of the private key.

But you need to sign this public key to make sure you can check no one modified it, but which key whould you use to sign it? If you could use the corresponding private key, then everyone would be able to take ownership of every Domain, therefore you need to sign the certificate making use of the private key of a third trusted entity.

Of course you trust this entity thanks to a certificate that has been signed but an other entity and so on till you find a certificate that is self-signed.

This is the only way to end end a loop that would be infinite otherwise, this self signed certificate identifies a root certificate authority (CA), you have a list of them in your Browser.

You can as well self-sign your own certificate, but since it will be not in the default list in the browser they will see a warning saying that your website is not trustable.

Therefore you should provide a certificate, the chain and the private key to protect your traffic and show your identity, therefore why they ask for different information?

Basically they ask for the same but formatted in different ways:

For App Engine they ask a "PEM encoded X.509 public key certificate" and the key, from the documentation you can notice that the certificate is "your concatenated SSL certificate" therefore is the whole chain
With the gcloud command the certificate and the key is needed, again the certificate is "The certificate chain must be no greater than 5 certs long. The chain must include at least one intermediate cert." again is the whole chain.
From the console you will need to provide the same information but divided, your certificate that is the "Public key certificate", then the chain composed buy intermetiate and root and finally the private key.

However I agree that is misleading and that the same information should be asked always in the same way.

For example for google.com the complete chain is:

The first one is the Public key certificate, the second one is the chain since there is not intermediate and it is as well the root certificate.

You can decode the certificate for example here.

The first certificate belongs to Google
The second one to GeoTrust Inc.

SSL Certificate for Load Balancer using gcloud

1 Answers

A brief summary on certificates