Knowledge Base
How to install and bind a server certificate on a Google Cloud Load Balancer
Overview
By the end of this guide, you will have prepared your certificate files in Privacy-Enhanced Mail (PEM) format, uploaded the certificate and private key to a Google Cloud HTTPS Load Balancer, bound the certificate to the load balancer's frontend, and verified that it serves HTTPS traffic correctly. It covers the prerequisites, combining the server certificate with the Certificate Authority (CA) intermediate chain, uploading the certificate in the Google Cloud Console, binding it to the load balancer, and verifying the result.
Prerequisites
-
Your SSL certificate: the certificate file (.crt, .cer, or .pem), the unencrypted private key (.key), and the full chain including intermediates (the Certificate Authority (CA) bundle)
-
All files in Privacy-Enhanced Mail (PEM) format — Google Cloud needs the certificate, private key, and intermediates in PEM
-
Access to the Google Cloud Console with permission to modify Load Balancer settings
Step 1: Prepare your certificate files
Make sure the certificate and private key are in PEM format. The combined certificate file should contain the server certificate followed by the intermediate certificates:
-----BEGIN CERTIFICATE-----
(Your server certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Intermediate CA)
-----END CERTIFICATE-----
The private key must appear as:
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
If needed, combine your certificate and CA bundle into one file:
cat your_domain.crt intermediate_bundle.crt > fullchain.pem
Step 2: Open the Google Cloud Console
-
Go to Navigation Menu > Network Services > Load Balancing.
-
Select your HTTPS Load Balancer.
-
Open the Frontend configuration tab.
Step 3: Upload the SSL certificate
-
In the Frontend configuration, ensure Protocol is HTTPS.
-
Under SSL Certificate, choose "Create a new certificate (Upload my certificate)."
-
Provide a Certificate Name, upload or paste fullchain.pem as the Certificate PEM, and upload or paste your .key file as the Private Key PEM.
-
Click Create.
Step 4: Bind the certificate to the load balancer
-
In the frontend configuration, select your new certificate.
-
Click Update or Save at the bottom and wait 1-3 minutes for propagation.
Verification
Confirm the correct certificate and full chain are served:
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com
You can also browse to https://yourdomain.com or use an SSL checker such as SSL Labs (https://www.ssllabs.com/ssltest/).
Need assistance?
Contact our team for help with your purchase or issuing your certificate.
Live chat
Click the button below or click "Chat with an Expert" to start chatting with us now!
