I am utterly failing to find a working guide for installing Let's Encrypt certificates on a single Google Cloud virtual machine.

I'm pretty clearly getting the picture that just doing the Apache webserver configuration isn't enough.

The information here, https://cloud.google.com/load-balancing/docs/ssl-certificates , seems to assume I'm doing load balancing--um, I'm on a tight budget here so it's only the one virtual machine. No load balancing.

I found some gcloud commands somewhere which I translate as:

  • gcloud compute ssl-certificates create partsunknownorg --certificate=/etc/letsencrypt/live/parts-unknown.org/fullchain.pem --private-key=/etc/letsencrypt/live/parts-unknown.org/privkey.pem
  • gcloud compute target-https-proxies update partsunknownorg --certificate=/etc/letsencrypt/live/parts-unknown.org/fullchain.pem --private-key=/etc/letsencrypt/live/parts-unknown.org/privkey.pem

I used the first one to try to install the certificates; I gather I should use the second to update them. Is that right?

In any event, it seems not to have worked. And I'm baffled.

  • 3
    If you have only a single virtual machine, why are you bothering with instructions for a load balancer (which presumably you don't have)? Or anything unusual at all? Just install Let's Encrypt normally. Being on Google Cloud isn't even relevant in your scenario. Mar 29 '19 at 12:47
  • 2
    If you're not using Google's load balancers, don't use any of the gcloud commands. Just follow a Let's Encrypt tutorial for your Linux distribution. edit: Argh, too slow! :-p
    – ceejayoz
    Mar 29 '19 at 12:47
  • Being on Google Cloud seems to be extremely relevant. I'm flat out getting SSL protocol errors with a configuration that worked when I wasn't on Google Cloud. As near as I can tell, I need to facilitate a man-in-the-middle here, the "man" being Google Cloud, but I can't tell how to feed it the keys. I tried looking at Google's SSL service, but that doesn't make any sense either. Mar 29 '19 at 15:39
  • For what it's worth, I also had to feed it ssh keys--editing ~/.ssh/authorized_keys file like I've done since time immemorial leads to a situation where ssh simply stops working. Mar 29 '19 at 15:42
  • 3
    There shouldn't be any man in the middle. Your domain should be pointed directly at the instance's IP if you're not using load balancing. The SSL error is probably a misconfiguration on your part. Follow a LE tutorial for your distribution, then test it out using something like ssllabs.com/ssltest and see what issues they report.
    – ceejayoz
    Mar 29 '19 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.