How to use Let's Encrypt with Google HTTPS Load Balancer and managed instance groups?

Question

I'm trying to understand how to use auto-scaling with an HTTPS Regional Load Balancer on Google Cloud. Their documentation recommends having the connection to the backend services (from the proxy) also be HTTPS. This makes me think I need:

• An instance template that contains an SSL certificate and Nginx configured to receive HTTPS traffic.
• Managed instance groups configured to receive traffic from the load balancer.
• A load balancer configured with a valid SSL certificate that receives incoming traffic and forwards it to the appropriate regional instance group (and also triggers scaling, according to Google's documentation).

I can't wrap my mind around how the SSL certificates should work with this setup, in spite of reading Google's SSL Certificates documentation and their various documentation pages about load balancers.

Assuming I would like to use Let's Encrypt and automate the renewal of the SSL certificates every 45 days, here are the questions I have:

• What does the instance template need to do in order to have a valid certificate? Or can I used self-signed certificates on the VMs? I'm using Docker on the instance template and struggling to generate a valid self-signed certificate when I spin up an instance on an ephemeral IP address.
• Does the instance template need a cron job and/or to use certbot to renew the SSL certificate every 45 days?
• Does Google provide a way to automate the renewal of SSL certificates that it manages on the HTTPS Load Balancer?

Finally:

• Is there a better way to be thinking about this problem or an easier solution to consider?

Answer 1

You can use self-signed certificates on the VMs. In fact, the self-signed certs I'm using with NGINX on my VMs all expired about 8 months ago. I don't believe the load balancer does any validation on the cert itself--it is just a necessary part of the SSL handshake.

You could attempt to generate something in the instance startup for its own IP, and a cron job to renew it. As above, I don't think it's necessary.

Google does not automate the replacement of the cert, but you can script it. The gcloud command-line utility has commands for creating and updating most resources including certificates and load balancers.