Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Richiedere un certificato utilizzando una Public CA e un client ACME
Questo tutorial ti guida nella richiesta di un certificato TLS con
l'Public Certificate Authority utilizzando Google Cloud CLI. Per informazioni sulle CA radice e intermedie utilizzate da Public Certificate Authority, vedi Google Trust Services. Non sono previsti costi
per la richiesta di certificati alla CA pubblica.
Prima di iniziare
Installa Google Cloud CLI.
Dopo l'installazione,
inizializza Google Cloud CLI eseguendo il seguente comando:
Per iniziare a utilizzare l'Public CA, devi installare un
client ACME. Le
istruzioni seguenti utilizzano
Certbot
come client ACME. Puoi utilizzare qualsiasi altro client ACME se supporta il collegamento di account esterni (EAB).
Assicurati di indirizzare il client al server Public CA. La prima
volta che il client ACME interagisce con l'autorità di certificazione pubblica, genera
una nuova coppia di chiavi e invia la chiave pubblica all'autorità di certificazione pubblica.
Richiedere un ID chiave EAB e un HMAC
Dopo aver installato un client ACME, devi registrare il tuo account ACME
con laPublic CAa per richiedere certificati alla CA pubblica.
Un segreto EAB può aiutarti a registrare il tuo account ACME con
una CA pubblica. Un secret EAB è costituito da un ID chiave e da un codice HMAC (Hash-based Message Authentication Code).
Per richiedere un ID chiave EAB e un HMAC, esegui questo comando:
gcloud publicca external-account-keys create
Questo comando restituisce un segreto EAB valido nell'ambiente di produzione
dell'autorità di certificazione pubblica. Nel corpo della risposta, il campo keyId
contiene l'ID chiave EAB e il campo b64MacKey contiene l'HMAC EAB.
Devi utilizzare un segreto EAB entro 7 giorni dall'ottenimento. Il segreto EAB viene
invalidato se non lo utilizzi entro 7 giorni. L'account ACME registrato
utilizzando un secret EAB non ha scadenza.
Registrare un account ACME
Questa sezione spiega come registrare un account ACME con
l'Public CAa fornendo il segreto EAB appena ottenuto.
Utilizza un normale client ACME per registrare un account ACME e fornisci l'ID chiave EAB e l'HMAC durante la registrazione.
Per registrare un account ACME con l'autorità della Public CA e associarlo al progetto Google Cloud che hai utilizzato per richiedere il secret EAB, esegui il seguente comando:
L'ambiente di staging restituisce certificati non attendibili pubblicamente.
L'ambiente di gestione temporanea esegue gli stessi controlli di convalida dell'ambiente di produzione. Puoi utilizzare l'ambiente di staging per l'integrazione o qualsiasi altro tipo di test.
Puoi registrare un solo account ACME con un segreto EAB. Dopo aver registrato un account ACME utilizzando un secret EAB, quest'ultimo diventa non valido e non può essere riutilizzato. Se vuoi registrare più account ACME, devi
richiedere un segreto EAB univoco per ciascun account.
Richiedere certificati
Una volta che la CA pubblica convalida il tuo controllo della destinazione del certificato
e riconosce che il tuo client ACME funziona come previsto per eseguire
le operazioni di gestione dei certificati, puoi utilizzare i normali flussi di lavoro ACME per
richiedere, rinnovare e revocare i certificati. Puoi eseguire queste operazioni utilizzando
il client ACME. Per richiedere e rinnovare un certificato, devi completare
una verifica ACME,
come la verifica DNS manuale.
Per utilizzare la verifica DNS manuale per richiedere un certificato, esegui questo comando:
SERVER: l'URL della directory ACME per l'ambiente di produzione o di staging
DOMAINS: un elenco separato da virgole di domini per i quali stai
richiedendo certificati
Esegui la pulizia
Se non hai più bisogno dei certificati per i tuoi domini,
elimina il progetto che hai creato.
Gestione temporanea
Puoi utilizzare l'ambiente di staging di Public CA per richiedere
certificati a scopo di test. I certificati emessi dalla catena dell'ambiente di staging
sono collegati a una CA radice di test.
I certificati dell'ambiente di staging non saranno considerati attendibili dai browser o da altri
client che non sono stati configurati per considerare attendibile il certificato radice di staging. Per ottenere un segreto EAB valido nell'ambiente di staging, esegui l'override dell'endpoint API per utilizzare l'endpoint per l'ambiente di staging:
gcloud config set api_endpoint_overrides/publicca https://preprod-publicca.googleapis.com/
Poi esegui il comando di creazione della chiave dell'account per creare una chiave di staging:
gcloud publicca external-account-keys create
Per ripristinare l'endpoint per l'ambiente di produzione, esegui questo comando:
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-01 UTC."],[[["\u003cp\u003eThis guide demonstrates how to request a TLS certificate from a Public Certificate Authority (CA) using the Google Cloud CLI and an ACME client like Certbot, with no cost for certificate requests.\u003c/p\u003e\n"],["\u003cp\u003eBefore proceeding, you'll need to install and initialize the Google Cloud CLI, create or select a Google Cloud project, and have either the Owner or Public CA External Account Key Creator IAM role.\u003c/p\u003e\n"],["\u003cp\u003eYou must install an ACME client and register an ACME account with Public CA using an External Account Binding (EAB) secret, which consists of a key ID and HMAC and is valid for 7 days.\u003c/p\u003e\n"],["\u003cp\u003eAfter registration, you can use standard ACME workflows with your client to request, renew, and revoke certificates, and to request a certificate, you will need to use an ACME challenge.\u003c/p\u003e\n"],["\u003cp\u003eThe guide also provides instructions for testing purposes using the staging environment of Public CA, which issues certificates that are not publicly trusted and details on how deleting a project invalidates linked ACME accounts and certificate renewal.\u003c/p\u003e\n"]]],[],null,["# Request a certificate using Public CA and an ACME client\n========================================================\n\nThis tutorial walks you through requesting a TLS certificate with\nPublic Certificate Authority by using the Google Cloud CLI. For information about the root and\nintermediate CAs used by Public Certificate Authority, see\n[Google Trust Services](https://pki.goog/). There is no charge\nfor requesting certificates from Public CA.\n\nBefore you begin\n----------------\n\n-\n\n\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n | **Note:** You can run the gcloud CLI in the Google Cloud console without installing the Google Cloud CLI. To run the gcloud CLI in the Google Cloud console, [use\n | Cloud Shell](https://console.cloud.google.com/?cloudshell=true).\n\n \u003cbr /\u003e\n\n-\n\n\n [Create or select a Google Cloud project](https://cloud.google.com/resource-manager/docs/creating-managing-projects).\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n - Create a Google Cloud project:\n\n ```\n gcloud projects create PROJECT_ID\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with a name for the Google Cloud project you are creating.\n - Select the Google Cloud project that you created:\n\n ```\n gcloud config set project PROJECT_ID\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your Google Cloud project name.\n- Make sure that you have the Public CA External Account Key\n Creator (`roles/publicca.externalAccountKeyCreator`) IAM role.\n\n To grant this role, run the following command: \n\n ```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=user:USER \\\n --role=roles/publicca.externalAccountKeyCreator\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of your Google Cloud project\n - \u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e: the unique identifier of the user to whom you want to assign the IAM role\n\n For information about granting an IAM role, see [Manage access\n to projects, folders, and\n organizations](/iam/docs/granting-changing-revoking-access).\n-\n\n\n Enable the Public CA API:\n\n\n ```bash\n gcloud services enable publicca.googleapis.com\n ```\n\n \u003cbr /\u003e\n\nInstall a client\n----------------\n\nTo get started using Public CA, you must install an\n[ACME client](https://acmeclients.com/). The\nfollowing instructions use\n[Certbot](https://certbot.eff.org/pages/about)\nas the ACME client. You can use any other ACME client if the client supports external account binding (EAB).\n\nTo install Certbot, see the [Certbot instructions](https://certbot.eff.org/instructions).\n\nMake sure to point your client to the Public CA server. The first\ntime the ACME client interacts with Public CA, the client generates\na new key pair and sends the public key to Public CA.\n\nRequest an EAB key ID and HMAC\n------------------------------\n\nAfter you install an ACME client, you must register your ACME account\nwith Public CA to request certificates from Public CA.\nAn EAB secret can help you register your ACME account with\nPublic CA. An EAB secret consists of a key ID and a hash-based\nmessage authentication code (HMAC).\n\nYou can use the [Public CA API](/certificate-manager/docs/reference/public-ca/rest) or the [Google Cloud CLI](/sdk/gcloud/reference/publicca) to request an EAB secret.\n\nTo request an EAB key ID and HMAC, run the following command: \n\n```\ngcloud publicca external-account-keys create\n```\n\nThis command returns an EAB secret that is valid on the production\nenvironment of Public CA. In the response body, the `keyId`\nfield contains the EAB key ID, and the `b64MacKey` field contains the EAB HMAC.\n\nYou must use an EAB secret within 7 days of obtaining it. The EAB secret is\ninvalidated if you don't use it within 7 days. The ACME account registered\nby using an EAB secret has no expiration.\n\nRegister an ACME account\n------------------------\n\nThis section explains how to register an ACME account with\nPublic CA by providing the EAB secret that you just obtained.\n\nUse a regular ACME client to register an ACME account, and provide the\nEAB key ID and HMAC while registering.\n| **Note:** If you are using the API, know that the HMAC is [base64\n| URL-encoded](https://datatracker.ietf.org/doc/html/rfc4648#section-5), which is slightly different from the regular base64 encoding.\n\nTo register an ACME account with Public CA and bind the ACME\naccount to the Google Cloud project that you used to request the EAB secret, run the\nfollowing command: \n\n```\ncertbot register \\\n --email \"EMAIL_ADDRESS\" \\\n --no-eff-email \\\n --server \"SERVER\" \\\n --eab-kid \"EAB_KID\" \\\n --eab-hmac-key \"EAB_HMAC_KEY\"\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eEMAIL_ADDRESS\u003c/var\u003e: your email address\n- \u003cvar translate=\"no\"\u003eSERVER\u003c/var\u003e: the ACME directory URL for the production or staging environment\n- \u003cvar translate=\"no\"\u003eEAB_KID\u003c/var\u003e: the EAB key ID\n- \u003cvar translate=\"no\"\u003eEAB_HMAC_KEY\u003c/var\u003e: the EAB HMAC key\n\nThe following table provides the description and the ACME directory URL for the\nproduction and staging environment:\n\nYou can only register one ACME account with an EAB secret. After you have\nregistered an ACME account by using an EAB secret, the EAB secret becomes invalid\nand you can't reuse it. If you want to register multiple ACME accounts, you must\nrequest a unique EAB secret for each of the accounts.\n\nRequest certificates\n--------------------\n\nAfter Public CA validates your control of the certificate target\nand acknowledges that your ACME client works as expected to perform\ncertificate management operations, you can use the regular ACME workflows to\nrequest, renew, and revoke certificates. You can perform these operations by using\nyour ACME client. To request and renew a certificate, you must complete\nan [ACME challenge](/certificate-manager/docs/public-ca#public-ca-challenges),\nsuch as the manual DNS challenge.\n\nTo use the manual DNS challenge to request a certificate, run the following\ncommand: \n\n```\ncertbot certonly \\\n --manual \\\n --preferred-challenges \"dns-01\" \\\n --server \"SERVER\" \\\n --domains \"DOMAINS\"\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eSERVER\u003c/var\u003e: the ACME directory URL for the production or staging environment\n- \u003cvar translate=\"no\"\u003eDOMAINS\u003c/var\u003e: a comma-separated list of domains for which you are requesting certificates\n\nClean up\n--------\n\n| **Caution:** Deleting a Google Cloud project invalidates all the ACME accounts that you have linked to the project. After your Google Cloud project is deleted, you will not be able to renew or issue certificates.\n\nIf you no longer need certificates for your domains,\ndelete the project that you created.\n\nStaging\n-------\n\nYou can use the staging environment of Public CA to request\ncertificates for testing purposes. The certificates issued by the staging\nenvironment chain up to a [test root CA](https://pki.goog/test_roots.pem).\nCertificates from the staging environment will not be trusted by Browsers or other\nclients that have not been configured to trust the staging root certificate. To obtain an EAB secret that is valid on the staging environment,\noverride the API endpoint to use the endpoint for the staging environment: \n\n```\ngcloud config set api_endpoint_overrides/publicca https://preprod-publicca.googleapis.com/\n```\nThen run the account key creation command to create a staging key: \n\n```\ngcloud publicca external-account-keys create\n```\nTo revert to the endpoint for the production environment, run the following command: \n\n```\ngcloud config unset api_endpoint_overrides/publicca\n```\n| **Caution** : Deleting a project has the following effects:\n|\n| - **Everything in the project is deleted.** If you used an existing project for the tasks in this document, when you delete it, you also delete any other work you've done in the project.\n| - **Custom project IDs are lost.** When you created this project, you might have created a custom project ID that you want to use in the future. To preserve the URLs that use the project ID, such as an `appspot.com` URL, delete selected resources inside the project instead of deleting the whole project.\n|\n|\n| If you plan to explore multiple architectures, tutorials, or quickstarts, reusing projects\n| can help you avoid exceeding project quota limits.\n\nDelete a Google Cloud project: \n\n```\ngcloud projects delete PROJECT_ID\n```\n\nWhat's next\n-----------\n\n- [Public Certificate Authority](/certificate-manager/docs/public-ca)"]]
