SSL certificates management in GCP - Mini Project: Build & Apply

SSL certificates management

📖 Scenario: You are managing a website hosted on Google Cloud Platform (GCP). To secure your website, you need to create and manage SSL certificates that encrypt data between your users and your site.

🎯 Goal: Build a simple configuration to create and manage an SSL certificate resource in GCP using Infrastructure as Code.

📋 What You'll Learn

Create a resource to hold SSL certificate details

Add a configuration variable for the certificate name

Use the main logic to define the SSL certificate resource with the correct properties

Complete the configuration with the final resource block for deployment

💡 Why This Matters

🌍 Real World

SSL certificates protect websites by encrypting data, ensuring user privacy and security.

💼 Career

Managing SSL certificates is a common task for cloud engineers and infrastructure specialists to secure cloud-hosted applications.

1

Create SSL certificate data structure

Create a dictionary called ssl_certificate_data with these exact entries: 'name': 'my-ssl-cert', 'certificate': '-----BEGIN CERTIFICATE-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END CERTIFICATE-----', and 'private_key': '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC...\n-----END PRIVATE KEY-----'.

GCP

# Create a dictionary called ssl_certificate_data with name, certificate, and private_key
# Your code here

Hint

Use a Python dictionary with keys 'name', 'certificate', and 'private_key' and assign the exact string values.

2

Add SSL certificate resource name variable

Create a variable called certificate_name and set it to the value of ssl_certificate_data['name'].

GCP

ssl_certificate_data = {
    'name': 'my-ssl-cert',
    'certificate': '-----BEGIN CERTIFICATE-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END CERTIFICATE-----',
    'private_key': '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC...\n-----END PRIVATE KEY-----'
}
# Create a variable certificate_name set to ssl_certificate_data['name']
# Your code here

Hint

Assign the value of the 'name' key from the ssl_certificate_data dictionary to certificate_name.

3

Define the SSL certificate resource

Create a dictionary called ssl_certificate_resource with keys 'name', 'type', and 'properties'. Set 'name' to certificate_name, 'type' to 'compute.v1.sslCertificate', and 'properties' to a dictionary with keys 'certificate' and 'privateKey' set to the corresponding values from ssl_certificate_data.

GCP

ssl_certificate_data = {
    'name': 'my-ssl-cert',
    'certificate': '-----BEGIN CERTIFICATE-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END CERTIFICATE-----',
    'private_key': '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC...\n-----END PRIVATE KEY-----'
}

certificate_name = ssl_certificate_data['name']
# Create ssl_certificate_resource dictionary with name, type, and properties
# Your code here

Hint

Use a nested dictionary structure to define the resource with the required keys and values.

4

Complete the deployment configuration

Create a list called resources containing the ssl_certificate_resource dictionary as its only element.

GCP

ssl_certificate_data = {
    'name': 'my-ssl-cert',
    'certificate': '-----BEGIN CERTIFICATE-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END CERTIFICATE-----',
    'private_key': '-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC...\n-----END PRIVATE KEY-----'
}

certificate_name = ssl_certificate_data['name']

ssl_certificate_resource = {
    'name': certificate_name,
    'type': 'compute.v1.sslCertificate',
    'properties': {
        'certificate': ssl_certificate_data['certificate'],
        'privateKey': ssl_certificate_data['private_key']
    }
}
# Create a list called resources containing ssl_certificate_resource
# Your code here

Hint

Wrap the ssl_certificate_resource dictionary inside a list assigned to resources.

Practice

1. What is the main purpose of an SSL certificate in Google Cloud Platform?

easy

A. To encrypt data between users and servers

B. To store user passwords securely

C. To monitor network traffic

D. To manage virtual machines

Solution

1. Step 1: Understand SSL certificate function

   SSL certificates encrypt data to keep communication secure.

2. Step 2: Identify correct purpose in GCP context

   Encrypting data between users and servers matches SSL certificate use.

3. Final Answer:

   To encrypt data between users and servers -> Option A

4. Quick Check:

   SSL certificates = encrypt data [OK]

Hint: SSL certificates secure data transfer by encryption [OK]

Common Mistakes:

• Confusing SSL with password storage
• Thinking SSL monitors traffic
• Assuming SSL manages VMs

2. Which gcloud command correctly creates a new SSL certificate in GCP?

easy

A. gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem

B. gcloud ssl create certificate my-cert --cert=cert.pem --key=key.pem

C. gcloud compute certificates add my-cert --cert=cert.pem --key=key.pem

D. gcloud create ssl my-cert --certificate=cert.pem --private-key=key.pem

Solution

1. Step 1: Recall correct gcloud syntax for SSL certificate creation

   The correct command uses 'gcloud compute ssl-certificates create' with certificate and private key flags.

2. Step 2: Match options to correct syntax

   gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem matches the correct syntax exactly; others use invalid commands or flags.

3. Final Answer:

   gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem -> Option A

4. Quick Check:

   Correct gcloud SSL create command = gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem [OK]

Hint: Use 'gcloud compute ssl-certificates create' with cert and key [OK]

Common Mistakes:

• Using wrong gcloud subcommands
• Mixing up flag names
• Omitting private key parameter

3. Given this command output listing SSL certificates in GCP:

NAME       CREATION_TIMESTAMP
my-cert    2023-05-01T12:00:00.000Z
old-cert   2022-01-15T08:30:00.000Z

Which certificate is most likely expired or needs renewal?

medium

A. Cannot determine from timestamps

B. my-cert

C. Both are valid

D. old-cert

Solution

1. Step 1: Analyze creation timestamps

   my-cert was created in May 2023; old-cert in January 2022.

2. Step 2: Consider typical SSL certificate validity

   SSL certificates usually last 1 year; old-cert is over a year old and likely expired.

3. Final Answer:

   old-cert -> Option D

4. Quick Check:

   Older certificate likely expired = old-cert [OK]

Hint: Older creation date usually means expired certificate [OK]

Common Mistakes:

• Assuming all certificates are valid
• Ignoring certificate age
• Thinking creation time equals expiration

4. You run this command to create an SSL certificate:

gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem

But get an error: "ERROR: (gcloud.compute.ssl-certificates.create) The private key file is invalid or missing." What is the most likely cause?

medium

A. The gcloud SDK is not installed

B. The certificate file is not in PEM format

C. The private key file path is incorrect or file is missing

D. The command requires a project flag

Solution

1. Step 1: Understand error message

   The error says the private key file is invalid or missing, indicating a problem with the key file.

2. Step 2: Identify common causes

   Incorrect file path or missing file for the private key is the most common cause.

3. Final Answer:

   The private key file path is incorrect or file is missing -> Option C

4. Quick Check:

   Private key file error = wrong path or missing file [OK]

Hint: Check private key file path and existence first [OK]

Common Mistakes:

• Blaming certificate format instead of key file
• Assuming gcloud SDK missing causes this error
• Forgetting to specify project flag

5. You want to automate SSL certificate renewal in GCP for a load balancer. Which approach best ensures certificates are renewed before expiration without downtime?

hard

A. Delete the old certificate and create a new one with the same name immediately

B. Create a new SSL certificate, update the load balancer to use it, then delete the old certificate

C. Manually update the certificate on the load balancer after expiration

D. Use the same certificate indefinitely without renewal

Solution

1. Step 1: Understand zero downtime renewal process

   Creating a new certificate and updating the load balancer before deleting old one avoids downtime.

2. Step 2: Evaluate options for automation and safety

   Create a new SSL certificate, update the load balancer to use it, then delete the old certificate follows best practice: create new cert, switch, then delete old cert.

3. Final Answer:

   Create a new SSL certificate, update the load balancer to use it, then delete the old certificate -> Option B

4. Quick Check:

   Renew by create-update-delete sequence = Create a new SSL certificate, update the load balancer to use it, then delete the old certificate [OK]

Hint: Renew by adding new cert, switch LB, then remove old cert [OK]

Common Mistakes:

• Deleting old cert before new one is ready
• Waiting until expiration to update
• Ignoring renewal and using expired cert