负载平衡器授权是颁发 Google 管理的证书的最简单方法。此方法可最大限度地减少对 DNS 配置的更改，但仅在负载均衡器配置完成后预配 TLS (SSL) 证书。这种方法还使负载均衡器授权非常适合没有现有生产流量的新环境。
如需创建具有负载均衡器授权的 Google 代管证书，您的部署必须满足以下要求：
必须能够通过端口 443 从为目标网域提供服务的所有 IP 地址访问 Google 管理的证书；否则，配置会失败。例如，如果您为 IPv4 和 IPv6 使用了单独的负载平衡器，则必须为它们分别分配相同的 Google 管理的证书。
您必须在 DNS 配置中明确指定负载平衡器的 IP 地址，以防止多视角网域验证失败。中间层（例如 CDN）可能会导致不可预测的行为。
目标网域必须可从互联网公开解析。水平分割或 DNS 防火墙环境可能会干扰证书预配。
DNS 授权
借助 DNS 授权，您无需等到生产环境完全设置完毕，即可验证域名所有权并预配 Google 管理的证书。当您将证书迁移到 Google Cloud时，这尤其有用。
证书管理器会通过 DNS 记录验证域名所有权。每个 DNS 授权都会存储 DNS 记录的相关信息，并涵盖单个网域及其通配符（例如 myorg.example.com 和 *.myorg.example.com）。通配符仅涵盖第一级子网域，不涵盖更深层级的子网域。例如，*.myorg.example.com 不涵盖 sub.subdomain.myorg.example.com。
创建 Google 管理的证书时，您可以使用一个或多个 DNS 授权来预配和续订证书。如果您为单个网域拥有多个证书，则可以对所有证书使用相同的 DNS 授权。不过，您的 DNS 授权必须涵盖证书中列出的所有网域；如果不涵盖，证书的创建和续期将会失败。
如需设置 DNS 授权，您必须将 CNAME 记录添加到 DNS 配置中。您可以使用此记录来验证目标网域下的子网域。CNAME 记录指向一个特殊的 Google Cloud 网域，Certificate Manager 会使用该网域来验证您的域名所有权。创建 DNS 授权后，Certificate Manager 会返回此 CNAME 记录并验证您的所有权。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eThis page details the two methods of domain authorization for Google-managed certificates: load balancer authorization and DNS authorization.\u003c/p\u003e\n"],["\u003cp\u003eLoad balancer authorization is quicker to configure but requires the load balancer to be fully set up and only works on port 443, while DNS authorization is more versatile by verifying domain ownership through DNS records and allows certificate provisioning in advance.\u003c/p\u003e\n"],["\u003cp\u003eDNS authorization enables the pre-provisioning of certificates before the production environment is live, and it's especially useful for migrating certificates to Google Cloud.\u003c/p\u003e\n"],["\u003cp\u003ePer-project DNS authorization allows each Google Cloud project to manage its certificates independently, with unique CNAME records for domain verification.\u003c/p\u003e\n"],["\u003cp\u003eUnlike load balancer and DNS authorization, domain authorization does not apply to Google-managed certificates issued by Certificate Authority Service.\u003c/p\u003e\n"]]],[],null,["# Domain authorization types for Google-managed certificates\n\nThis page describes how domain authorization works with Google-managed\ncertificates. The page compares load balancer authorization to DNS authorization\nand explains how Certificate Manager verifies domain ownership\nusing each method.\n\nCertificate Manager lets you prove ownership of domains for which\nyou want to issue Google-managed certificates in one of the following ways:\n\n- **Load balancer authorization**: deploy the certificate directly to a\n supported load balancer without creating a DNS record. This method is faster\n to configure, but it doesn't support wildcard certificates or regional\n certificates. Additionally, Certificate Manager can only\n provision certificates after the load balancer has been fully set up and is\n serving network traffic.\n\n- **DNS authorization**: deploy the certificate directly to a supported load\n balancer after creating dedicated DNS records for verification of domain\n ownership. Using this method, Certificate Manager can\n provision certificates in advance, before the target proxy is ready to serve\n network traffic.\n\nDomain authorization doesn't apply to Google-managed certificates issued by\nCertificate Authority Service. For more information about such certificates, see [Deploy a\nglobal Google-managed certificate with Certificate Authority Service](/certificate-manager/docs/deploy-google-managed-cas).\n\nLoad balancer authorization\n---------------------------\n\nLoad balancer authorization is the simplest method for issuing a Google-managed\ncertificate. This method minimizes changes to your DNS configuration, but only\nprovisions the TLS (SSL) certificate after the load balancer configuration is\ncomplete. This method also makes load balancer authorization ideal for new\nenvironments with no existing production traffic.\n\nTo create Google-managed certificates with load balancer authorization, your\ndeployment must meet the following requirements:\n\n- The Google-managed certificate must be accessible on port 443 from all IP addresses serving the target domain; otherwise, provisioning fails. For example, if you have separate load balancers for IPv4 and IPv6, you must assign the same Google-managed certificate to each of them.\n- You must explicitly specify the IP addresses of your load balancers in your DNS configuration, which prevents [multi-perspective domain validation\n failures](/certificate-manager/docs/troubleshooting#multi-perspective-domain-validation). Intermediate layers, such as CDN, can cause unpredictable behavior.\n- The target domain must be openly resolvable from the Internet. Split-horizon or DNS firewall environments can interfere with certificate provisioning.\n\nDNS authorization\n-----------------\n\nDNS authorization lets you verify domain ownership and provision Google-managed\ncertificates even before your production environment is fully set up. This is\nparticularly useful when you're migrating certificates to Google Cloud.\n\nCertificate Manager verifies domain ownership through DNS\nrecords. Each DNS authorization stores information about a DNS record, and\ncovers a single domain and its wildcard (for example, both `myorg.example.com`\nand `*.myorg.example.com`). A wildcard covers only the first subdomain level, and\ndoesn't cover deeper subdomain levels. For example, `*.myorg.example.com` doesn't cover\n`sub.subdomain.myorg.example.com`.\n\nWhen creating a Google-managed certificate, you can use one or more DNS\nauthorizations to provision and renew certificates. If you have\nmultiple certificates for a single domain, then you can use the same DNS\nauthorization for all the certificates. However, your DNS authorizations must cover all\ndomains listed in the certificate; if they don't, creating and renewing\ncertificates will fail.\n\nTo set up DNS authorization, you must add a `CNAME` record to your DNS\nconfiguration. You can use this record to validate the subdomain under your\ntarget domain. The `CNAME` record points to a special Google Cloud domain\nthat Certificate Manager uses to verify your domain ownership.\nWhen you create a DNS authorization, Certificate Manager returns\nthis `CNAME` record and verifies your ownership.\n\nRemember, the `CNAME` record also grants Certificate Manager\nthe permission to provision and renew certificates for the target domain within your\nGoogle Cloud project. To revoke these permissions, remove the CNAME record\nfrom your DNS configuration.\n| **Note:** The validation sub-domain must be openly resolvable from the internet. Split-horizon or DNS firewall environments can interfere with certificate provisioning.\n\n### Per-project DNS authorization\n\nPer-project DNS authorization lets you manage certificates independently within\neach Google Cloud project. Using per-project DNS authorization,\nCertificate Manager can issue and handle certificates for each\nproject separately. The DNS authorizations and certificates used within a\nproject are self-contained and don't interact with artifacts from other\nprojects.\n\nTo activate per-project DNS authorization, choose the `PER_PROJECT_RECORD`\noption when creating a DNS authorization. You will then receive a unique `CNAME`\nrecord that includes both a subdomain and a target specific to that project.\nYou shoud add this `CNAME` record to the DNS zone of the relevant domain.\n| **Note:** Due to ongoing IETF standardization efforts for account-based DNS authorization, Google uses a custom implementation of account-based DNS authorization for per-project DNS authorizations.\n\nCompare load balancer authorization with DNS authorization\n----------------------------------------------------------\n\nCertificate Manager lets you prove ownership of domains for which\nyou want to issue Google-managed certificates as described in the following\ntable.\n\nWhat's next\n-----------\n\n- [Manage DNS authorizations](/certificate-manager/docs/dns-authorizations)\n- [Deploy a global Google-managed certificate with load balancer\n authorization](/certificate-manager/docs/deploy-google-managed-lb-auth)\n- [Deploy a global Google-managed certificate with DNS authorization](/certificate-manager/docs/deploy-google-managed-dns-auth)"]]
