将第三方证书迁移到证书管理器

本教程介绍如何使用 Certificate Manager 将第三方证书迁移到Google Cloud 负载均衡器。

如需在不中断服务的情况下迁移第三方证书，请创建与第三方证书数量相同的 Google 管理型证书。接下来，将证书整合到单个证书映射中，并使用 DNS 将证书映射部署到负载均衡器。最后，更新 DNS A 和 AAAA 记录以指向负载均衡器的 IP 地址。

如需查看受支持的负载平衡器的列表，请参阅 Certificate Manager 概览。

目标

本教程介绍如何完成以下任务：

  • 创建具有 DNS 授权的 Google 管理的证书。
  • 为所有证书创建一个证书映射。
  • 使用 DNS 将证书部署到负载均衡器。
  • 更新 DNS A 和 AAAA 记录以指向负载均衡器的 IP 地址。

准备工作

  1. 登录您的 Google Cloud 账号。如果您是 Google Cloud新手，请 创建一个账号来评估我们的产品在实际场景中的表现。新客户还可获享 $300 赠金，用于运行、测试和部署工作负载。

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Compute Engine, Certificate Manager APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  5. 安装 Google Cloud CLI。

  6. 如果您使用的是外部身份提供方 (IdP)，则必须先使用联合身份登录 gcloud CLI。

  7. 如需初始化 gcloud CLI，请运行以下命令： 

    gcloud init

  8. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  9. Verify that billing is enabled for your Google Cloud project.

  10. Enable the Compute Engine, Certificate Manager APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  11. 安装 Google Cloud CLI。

  12. 如果您使用的是外部身份提供方 (IdP)，则必须先使用联合身份登录 gcloud CLI。

  13. 如需初始化 gcloud CLI，请运行以下命令： 

    gcloud init

所需的角色

请确保您拥有以下角色，以便完成本教程中的任务：

  • Certificate Manager Owner (roles/certificatemanager.owner)

    创建和管理 Certificate Manager 资源所需的角色。

  • Compute Load Balancer Admin (roles/compute.loadBalancerAdmin) 或 Compute Network Admin (roles/compute.networkAdmin)

    创建和管理 HTTPS 目标代理时需要此权限。