I'm trying to understand how to use auto-scaling with an HTTPS Regional Load Balancer on Google Cloud. Their documentation recommends having the connection to the backend services (from the proxy) also be HTTPS. This makes me think I need:
- An instance template that contains an SSL certificate and Nginx configured to receive HTTPS traffic.
- Managed instance groups configured to receive traffic from the load balancer.
- A load balancer configured with a valid SSL certificate that receives incoming traffic and forwards it to the appropriate regional instance group (and also triggers scaling, according to Google's documentation).
I can't wrap my mind around how the SSL certificates should work with this setup, in spite of reading Google's SSL Certificates documentation and their various documentation pages about load balancers.
Assuming I would like to use Let's Encrypt and automate the renewal of the SSL certificates every 45 days, here are the questions I have:
- What does the instance template need to do in order to have a valid certificate? Or can I used self-signed certificates on the VMs? I'm using Docker on the instance template and struggling to generate a valid self-signed certificate when I spin up an instance on an ephemeral IP address.
- Does the instance template need a cron job and/or to use certbot to renew the SSL certificate every 45 days?
- Does Google provide a way to automate the renewal of SSL certificates that it manages on the HTTPS Load Balancer?
- Is there a better way to be thinking about this problem or an easier solution to consider?