Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Meminta sertifikat menggunakan Public CA dan klien ACME
Tutorial ini akan memandu Anda meminta sertifikat TLS dengan
Otoritas Sertifikat Publik menggunakan Google Cloud CLI. Untuk mengetahui informasi tentang CA root dan CA perantara yang digunakan oleh Public Certificate Authority, lihat Google Trust Services. Tidak ada biaya
untuk meminta sertifikat dari CA Publik.
Sebelum memulai
Menginstal Google Cloud CLI.
Setelah penginstalan,
lakukan inisialisasi Google Cloud CLI dengan menjalankan perintah berikut:
Untuk mulai menggunakan CA Publik, Anda harus menginstal
klien ACME. Petunjuk
berikut menggunakan
Certbot
sebagai klien ACME. Anda dapat menggunakan klien ACME lain jika klien tersebut mendukung pengikatan akun eksternal (EAB).
Pastikan untuk mengarahkan klien Anda ke server CA Publik. Saat pertama kali berinteraksi dengan CA Publik, klien ACME akan membuat pasangan kunci baru dan mengirim kunci publik ke CA Publik.
Meminta ID kunci dan HMAC EAB
Setelah menginstal klien ACME, Anda harus mendaftarkan akun ACME Anda dengan CA Publik untuk meminta sertifikat dari CA Publik.
Rahasia EAB dapat membantu Anda mendaftarkan akun ACME Anda dengan CA Publik. Rahasia EAB terdiri dari ID kunci dan kode autentikasi pesan (HMAC) berbasis hash.
Untuk meminta ID kunci EAB dan HMAC, jalankan perintah berikut:
gcloud publicca external-account-keys create
Perintah ini akan menampilkan rahasia EAB yang valid di lingkungan produksi CA Publik. Di isi respons, kolom keyId
berisi ID kunci EAB, dan kolom b64MacKey berisi HMAC EAB.
Anda harus menggunakan rahasia EAB dalam waktu 7 hari setelah mendapatkannya. Rahasia EAB akan dibatalkan jika Anda tidak menggunakannya dalam waktu 7 hari. Akun ACME yang didaftarkan menggunakan secret EAB tidak memiliki masa berlaku.
Mendaftarkan akun ACME
Bagian ini menjelaskan cara mendaftarkan akun ACME dengan CA Publik dengan memberikan rahasia EAB yang baru saja Anda dapatkan.
Gunakan klien ACME reguler untuk mendaftarkan akun ACME, dan berikan
ID kunci EAB dan HMAC saat mendaftar.
Untuk mendaftarkan akun ACME dengan CA Publik dan mengikat akun ACME ke Google Cloud project yang Anda gunakan untuk meminta rahasia EAB, jalankan perintah berikut:
SERVER: URL direktori ACME untuk
lingkungan produksi atau penyiapan
EAB_KID: ID kunci EAB
EAB_HMAC_KEY: kunci HMAC EAB
Tabel berikut memberikan deskripsi dan URL direktori ACME untuk lingkungan produksi dan penyiapan:
Lingkungan
Deskripsi
URL direktori ACME
Produksi
Lingkungan produksi memungkinkan Anda mendapatkan sertifikat yang dipercaya secara publik.
https://dv.acme-v02.api.pki.goog/directory
Staging
Lingkungan penyiapan menampilkan sertifikat yang tidak dipercaya secara publik.
Lingkungan staging melakukan pemeriksaan validasi yang sama dengan lingkungan
produksi. Anda dapat menggunakan lingkungan staging untuk integrasi atau jenis pengujian lainnya.
https://dv.acme-v02.test-api.pki.goog/directory
Anda hanya dapat mendaftarkan satu akun ACME dengan rahasia EAB. Setelah Anda mendaftarkan akun ACME menggunakan rahasia EAB, rahasia EAB menjadi tidak valid dan Anda tidak dapat menggunakannya kembali. Jika ingin mendaftarkan beberapa akun ACME, Anda harus
meminta rahasia EAB unik untuk setiap akun.
Minta sertifikat
Setelah CA Publik memvalidasi kontrol Anda atas target sertifikat
dan mengonfirmasi bahwa klien ACME Anda berfungsi seperti yang diharapkan untuk melakukan
operasi pengelolaan sertifikat, Anda dapat menggunakan alur kerja ACME biasa untuk
meminta, memperpanjang, dan mencabut sertifikat. Anda dapat melakukan operasi ini menggunakan
klien ACME Anda. Untuk meminta dan memperpanjang sertifikat, Anda harus menyelesaikan
tantangan ACME,
seperti tantangan DNS manual.
Untuk menggunakan tantangan DNS manual guna meminta sertifikat, jalankan perintah berikut:
SERVER: URL direktori ACME untuk lingkungan produksi atau staging
DOMAINS: daftar domain yang dipisahkan koma yang sertifikatnya Anda minta
Pembersihan
Jika Anda tidak lagi memerlukan sertifikat untuk domain Anda,
hapus project yang Anda buat.
Staging
Anda dapat menggunakan lingkungan staging CA Publik untuk meminta
sertifikat untuk tujuan pengujian. Sertifikat yang dikeluarkan oleh lingkungan staging dirantai hingga CA root pengujian.
Sertifikat dari lingkungan penyiapan tidak akan dipercayai oleh Browser atau klien lain yang belum dikonfigurasi untuk memercayai sertifikat root penyiapan. Untuk mendapatkan secret EAB yang valid di lingkungan staging,
ganti endpoint API untuk menggunakan endpoint untuk lingkungan staging:
gcloud config set api_endpoint_overrides/publicca https://preprod-publicca.googleapis.com/
Kemudian, jalankan perintah pembuatan kunci akun untuk membuat kunci penyiapan:
gcloud publicca external-account-keys create
Untuk kembali ke endpoint untuk lingkungan produksi, jalankan perintah
berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[[["\u003cp\u003eThis guide demonstrates how to request a TLS certificate from a Public Certificate Authority (CA) using the Google Cloud CLI and an ACME client like Certbot, with no cost for certificate requests.\u003c/p\u003e\n"],["\u003cp\u003eBefore proceeding, you'll need to install and initialize the Google Cloud CLI, create or select a Google Cloud project, and have either the Owner or Public CA External Account Key Creator IAM role.\u003c/p\u003e\n"],["\u003cp\u003eYou must install an ACME client and register an ACME account with Public CA using an External Account Binding (EAB) secret, which consists of a key ID and HMAC and is valid for 7 days.\u003c/p\u003e\n"],["\u003cp\u003eAfter registration, you can use standard ACME workflows with your client to request, renew, and revoke certificates, and to request a certificate, you will need to use an ACME challenge.\u003c/p\u003e\n"],["\u003cp\u003eThe guide also provides instructions for testing purposes using the staging environment of Public CA, which issues certificates that are not publicly trusted and details on how deleting a project invalidates linked ACME accounts and certificate renewal.\u003c/p\u003e\n"]]],[],null,["# Request a certificate using Public CA and an ACME client\n========================================================\n\nThis tutorial walks you through requesting a TLS certificate with\nPublic Certificate Authority by using the Google Cloud CLI. For information about the root and\nintermediate CAs used by Public Certificate Authority, see\n[Google Trust Services](https://pki.goog/). There is no charge\nfor requesting certificates from Public CA.\n\nBefore you begin\n----------------\n\n-\n\n\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n | **Note:** You can run the gcloud CLI in the Google Cloud console without installing the Google Cloud CLI. To run the gcloud CLI in the Google Cloud console, [use\n | Cloud Shell](https://console.cloud.google.com/?cloudshell=true).\n\n \u003cbr /\u003e\n\n-\n\n\n [Create or select a Google Cloud project](https://cloud.google.com/resource-manager/docs/creating-managing-projects).\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n - Create a Google Cloud project:\n\n ```\n gcloud projects create PROJECT_ID\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with a name for the Google Cloud project you are creating.\n - Select the Google Cloud project that you created:\n\n ```\n gcloud config set project PROJECT_ID\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your Google Cloud project name.\n- Make sure that you have the Public CA External Account Key\n Creator (`roles/publicca.externalAccountKeyCreator`) IAM role.\n\n To grant this role, run the following command: \n\n ```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=user:USER \\\n --role=roles/publicca.externalAccountKeyCreator\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of your Google Cloud project\n - \u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e: the unique identifier of the user to whom you want to assign the IAM role\n\n For information about granting an IAM role, see [Manage access\n to projects, folders, and\n organizations](/iam/docs/granting-changing-revoking-access).\n-\n\n\n Enable the Public CA API:\n\n\n ```bash\n gcloud services enable publicca.googleapis.com\n ```\n\n \u003cbr /\u003e\n\nInstall a client\n----------------\n\nTo get started using Public CA, you must install an\n[ACME client](https://acmeclients.com/). The\nfollowing instructions use\n[Certbot](https://certbot.eff.org/pages/about)\nas the ACME client. You can use any other ACME client if the client supports external account binding (EAB).\n\nTo install Certbot, see the [Certbot instructions](https://certbot.eff.org/instructions).\n\nMake sure to point your client to the Public CA server. The first\ntime the ACME client interacts with Public CA, the client generates\na new key pair and sends the public key to Public CA.\n\nRequest an EAB key ID and HMAC\n------------------------------\n\nAfter you install an ACME client, you must register your ACME account\nwith Public CA to request certificates from Public CA.\nAn EAB secret can help you register your ACME account with\nPublic CA. An EAB secret consists of a key ID and a hash-based\nmessage authentication code (HMAC).\n\nYou can use the [Public CA API](/certificate-manager/docs/reference/public-ca/rest) or the [Google Cloud CLI](/sdk/gcloud/reference/publicca) to request an EAB secret.\n\nTo request an EAB key ID and HMAC, run the following command: \n\n```\ngcloud publicca external-account-keys create\n```\n\nThis command returns an EAB secret that is valid on the production\nenvironment of Public CA. In the response body, the `keyId`\nfield contains the EAB key ID, and the `b64MacKey` field contains the EAB HMAC.\n\nYou must use an EAB secret within 7 days of obtaining it. The EAB secret is\ninvalidated if you don't use it within 7 days. The ACME account registered\nby using an EAB secret has no expiration.\n\nRegister an ACME account\n------------------------\n\nThis section explains how to register an ACME account with\nPublic CA by providing the EAB secret that you just obtained.\n\nUse a regular ACME client to register an ACME account, and provide the\nEAB key ID and HMAC while registering.\n| **Note:** If you are using the API, know that the HMAC is [base64\n| URL-encoded](https://datatracker.ietf.org/doc/html/rfc4648#section-5), which is slightly different from the regular base64 encoding.\n\nTo register an ACME account with Public CA and bind the ACME\naccount to the Google Cloud project that you used to request the EAB secret, run the\nfollowing command: \n\n```\ncertbot register \\\n --email \"EMAIL_ADDRESS\" \\\n --no-eff-email \\\n --server \"SERVER\" \\\n --eab-kid \"EAB_KID\" \\\n --eab-hmac-key \"EAB_HMAC_KEY\"\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eEMAIL_ADDRESS\u003c/var\u003e: your email address\n- \u003cvar translate=\"no\"\u003eSERVER\u003c/var\u003e: the ACME directory URL for the production or staging environment\n- \u003cvar translate=\"no\"\u003eEAB_KID\u003c/var\u003e: the EAB key ID\n- \u003cvar translate=\"no\"\u003eEAB_HMAC_KEY\u003c/var\u003e: the EAB HMAC key\n\nThe following table provides the description and the ACME directory URL for the\nproduction and staging environment:\n\nYou can only register one ACME account with an EAB secret. After you have\nregistered an ACME account by using an EAB secret, the EAB secret becomes invalid\nand you can't reuse it. If you want to register multiple ACME accounts, you must\nrequest a unique EAB secret for each of the accounts.\n\nRequest certificates\n--------------------\n\nAfter Public CA validates your control of the certificate target\nand acknowledges that your ACME client works as expected to perform\ncertificate management operations, you can use the regular ACME workflows to\nrequest, renew, and revoke certificates. You can perform these operations by using\nyour ACME client. To request and renew a certificate, you must complete\nan [ACME challenge](/certificate-manager/docs/public-ca#public-ca-challenges),\nsuch as the manual DNS challenge.\n\nTo use the manual DNS challenge to request a certificate, run the following\ncommand: \n\n```\ncertbot certonly \\\n --manual \\\n --preferred-challenges \"dns-01\" \\\n --server \"SERVER\" \\\n --domains \"DOMAINS\"\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eSERVER\u003c/var\u003e: the ACME directory URL for the production or staging environment\n- \u003cvar translate=\"no\"\u003eDOMAINS\u003c/var\u003e: a comma-separated list of domains for which you are requesting certificates\n\nClean up\n--------\n\n| **Caution:** Deleting a Google Cloud project invalidates all the ACME accounts that you have linked to the project. After your Google Cloud project is deleted, you will not be able to renew or issue certificates.\n\nIf you no longer need certificates for your domains,\ndelete the project that you created.\n\nStaging\n-------\n\nYou can use the staging environment of Public CA to request\ncertificates for testing purposes. The certificates issued by the staging\nenvironment chain up to a [test root CA](https://pki.goog/test_roots.pem).\nCertificates from the staging environment will not be trusted by Browsers or other\nclients that have not been configured to trust the staging root certificate. To obtain an EAB secret that is valid on the staging environment,\noverride the API endpoint to use the endpoint for the staging environment: \n\n```\ngcloud config set api_endpoint_overrides/publicca https://preprod-publicca.googleapis.com/\n```\nThen run the account key creation command to create a staging key: \n\n```\ngcloud publicca external-account-keys create\n```\nTo revert to the endpoint for the production environment, run the following command: \n\n```\ngcloud config unset api_endpoint_overrides/publicca\n```\n| **Caution** : Deleting a project has the following effects:\n|\n| - **Everything in the project is deleted.** If you used an existing project for the tasks in this document, when you delete it, you also delete any other work you've done in the project.\n| - **Custom project IDs are lost.** When you created this project, you might have created a custom project ID that you want to use in the future. To preserve the URLs that use the project ID, such as an `appspot.com` URL, delete selected resources inside the project instead of deleting the whole project.\n|\n|\n| If you plan to explore multiple architectures, tutorials, or quickstarts, reusing projects\n| can help you avoid exceeding project quota limits.\n\nDelete a Google Cloud project: \n\n```\ngcloud projects delete PROJECT_ID\n```\n\nWhat's next\n-----------\n\n- [Public Certificate Authority](/certificate-manager/docs/public-ca)"]]
