Is there a way to renew an SslCertificate resource on the Google Cloud load balancer when the underlying certificate expires, or do you have to create a new resource with the renewed certificate?

I'm referring to this service: https://cloud.google.com/compute/docs/load-balancing/http/ssl-certificates (Note the lack of reference to renewing a certificate).

Thanks, all!


2 Answers 2


On Google’s Global HTTP Load Balancer, each HTTPS target proxy is linked to a certificate. You can use the gcloud tool (pre-installed on GCE images) to update your target proxies with new certificates. But make sure that:

  • Your version of gcloud is relatively recent. The target-https-proxies commands were only recently added, so they aren’t present in older versions of gcloud. (Not to be confused with target-http-proxies, which manges plaintext HTTP sites)
  • Your renewal server has API access to Compute Engine resources. You can configure this in your GCE templates, or on a instance-by-instance basis.

You can query gcloud for the current certificate, to check if it’s about to expire. If it is, you can upload your new certificate, then use the target-https-proxies update command to switch over to the new certificate. You won’t see the changes immediately, but soon, the renewed certificate should be installed globally.

There’s a usage quota of 30 SSL certificates (at least on my account). But if you aren’t too aggressive with your renewals, you won’t have any problems even if your renewal script doesn’t clean out expired certificates. It’d be a good idea to keep around at least 1 old certificate, just in case something goes wrong and you need to revert.

  • 4
    The commands are gcloud compute ssl-certificates create mynewcert --certificate mynewcertfile.crt --private-key mykeyfile.key and then gcloud compute target-https-proxies update my-https-proxy --ssl-certificate mynewcert Commented Aug 30, 2017 at 5:06
  • 2
    A small typo in the above command it should be: gcloud compute target-https-proxies update my-https-proxy --ssl-certificates mynewcert Thats what worked today Commented Sep 22, 2018 at 10:58

Looks like Google offer you another solution, you could create new certificate, create new SslCertificate resource and put it on load balancer. It would allow you to change certificates without downtime, if there is something wrong with new cert. In the end you could drop expired SslCertificate recource.

  • Thanks, Alexander -- that's what I'm going to end up doing. I'm really hoping there's a way to fully automate it with LetsEncrypt.org, but I'm not finding any way to do that... Commented Aug 14, 2017 at 21:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .