Unable to setup SSL Certificate on Google Cloud, status being “FAILED_NOT_VISIBLE”

Question

We are trying to setup ssl certificate for our domain, api.rideonstyle.in. We encountered a situation where the certificate status is in FAILED_NOT_VISIBLE. Tried all the steps that are suggested in the documentation .

Here are the screenshots, We checked the conditions given in the documentation, when certificate status shows FAILED_NOT_VISIBLE. Looks like all the required conditions are met, but still we face this issue.

1. Updated the DNS records with the load balancer IP address.

Result from finding the IP.

IP address mapping to domain name

Load balancer IP details on Google cloud

2. SSL certificate is attached to the load balancer proxy, and added a forwarding rule to port 443.

specification about load-balancer proxy and forwarding rule

Even after reading a few articles on stack-overflow / some other articles, we couldn't find the exact reason why it is happening this way. Previously it used to work properly, but in recent times, we are getting error from certificate.

certificate details

Answer 1

Can you please clarify how long have you waited after updating the DNS record pointing to the load balancer ip?

I'm requesting this information, since as per gcp documentation,it might take upto 24 hours for DNS record can be propagated and could take time for managed certificate to be provisioned.

Additionally, I would also recommend verifying the load balancer from GKE service and make sure you have attached the certificate to the correct load balancer.

Answer 2

SSl Certificate will not work for a TCP load balancer. It has to be HTTPS. In the screenshot where you see "Service Details" and the external endpoint, please scroll down until you see something like:

Load Balancer

Cluster IP Load balancer IP Load balancer (here you will have the LB name)

Copy it and then go to Network Services > Load Balancing. Find your load balancer, and if it says TCP it won't work. It HAS to be an HTTPS load balancer. Alternatively, you can install a self managed certificate in the backend. This would be done entirely on your own.