I'm trying to understand how to use auto-scaling with an HTTPS Regional Load Balancer on Google Cloud. Their documentation recommends having the connection to the backend services (from the proxy) also be HTTPS. This makes me think I need:

  • An instance template that contains an SSL certificate and Nginx configured to receive HTTPS traffic.
  • Managed instance groups configured to receive traffic from the load balancer.
  • A load balancer configured with a valid SSL certificate that receives incoming traffic and forwards it to the appropriate regional instance group (and also triggers scaling, according to Google's documentation).

I can't wrap my mind around how the SSL certificates should work with this setup, in spite of reading Google's SSL Certificates documentation and their various documentation pages about load balancers.

Assuming I would like to use Let's Encrypt and automate the renewal of the SSL certificates every 45 days, here are the questions I have:

  • What does the instance template need to do in order to have a valid certificate? Or can I used self-signed certificates on the VMs? I'm using Docker on the instance template and struggling to generate a valid self-signed certificate when I spin up an instance on an ephemeral IP address.
  • Does the instance template need a cron job and/or to use certbot to renew the SSL certificate every 45 days?
  • Does Google provide a way to automate the renewal of SSL certificates that it manages on the HTTPS Load Balancer?


  • Is there a better way to be thinking about this problem or an easier solution to consider?

1 Answer 1


You can use self-signed certificates on the VMs. In fact, the self-signed certs I'm using with NGINX on my VMs all expired about 8 months ago. I don't believe the load balancer does any validation on the cert itself--it is just a necessary part of the SSL handshake.

You could attempt to generate something in the instance startup for its own IP, and a cron job to renew it. As above, I don't think it's necessary.

Google does not automate the replacement of the cert, but you can script it. The gcloud command-line utility has commands for creating and updating most resources including certificates and load balancers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .