Your enterprise platform team is preparing to migrate several multi-tenant custom domains (including wildcard domains) to a global External Application Load Balancer. You are designing an automated CI/CD deployment pipeline using Google Cloud Certificate Manager to manage public SSL/TLS certificates. You have the following operational requirements: Certificates must be fully provisioned, validated, and active prior to shifting public production traffic to prevent TLS handshake errors and downtime. Domain ownership validation must support wildcard domains and domains whose live DNS A/AAAA records still point to legacy infrastructure. Certificates and domain routing must scale dynamically beyond standard target proxy certificate limits and support automated zero-downtime renewals. Which workflow should you implement in your automated deployment pipeline to satisfy these requirements?

Create Certificate Manager DNS authorizations, publish the generated CNAME challenge records to the authoritative DNS provider, provision Google-managed certificates referencing these DNS authorizations, map the certificates to domain entries within a Certificate Map, and attach the Certificate Map to the target HTTPS proxy.: ### What Certificate Manager DNS Authorization and Certificate Maps Are **Google Cloud Certificate Manager** is a dedicated service designed to centrally manage, provision, and bind public and private SSL/TLS certificates to Google Cloud load balancers. It replaces traditional target proxy certificate lists by introducing **Certificate Maps** and **DNS Authorizations**, enabling automated zero-downtime certificate lifecycle management and scaling to hundreds of thousands of domain certificates. ### How it meets the requirements - **Pre-provisioning and zero downtime**: Creating **DNS authorizations** allows domain control validation (DCV) to complete via DNS **CNAME** challenge records before cutting over production traffic. This ensures that Google-managed certificates are issued, verified, and in an `ACTIVE` state before modifying customer-facing DNS records. - **Wildcard and legacy traffic support**: DNS authorization is mandatory for validating **wildcard domains** (e.g., `*.example.com`) and allows provisioning certificates for domains currently serving live traffic on third-party infrastructure without requiring downtime or temporary HTTP routing. - **Scalability via Certificate Maps**: Using a **Certificate Map** with granular **Certificate Map Entries** allows decoupling certificate associations from the target HTTPS proxy, bypassing legacy quotas (such as the target proxy limit of 15 certificates) and automating continuous certificate renewals without redeploying the load balancer. ### Key advantages and capabilities - **Automated Renewals**: Certificate Manager automatically tracks certificate expiration and renews certificates using the established DNS authorization challenge records without administrator intervention. - **High Capacity**: Supports up to hundreds of thousands of certificates per load balancer using map entries. - **Decoupled Architecture**: Enables infrastructure-as-code CI/CD pipelines to independently manage DNS authorizations, certificates, and mapping entries without modifying proxy configurations. ### Why this is optimal This sequence guarantees that certificates are valid and active prior to DNS cutover, fully supports wildcard domain validation, and leverages modern Certificate Maps attached to the Target HTTPS Proxy for automated renewals and maximum scalability.

Certificate Manager Dns Authorization Map Workflow | Professional Cloud DevOps Engineer

Certificate Manager Dns Authorization Map Workflow

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise platform team is preparing to migrate several multi-tenant custom domains (including wildcard domains) to a global External Application Load Balancer. You are designing an automated CI/CD deployment pipeline using Google Cloud Certificate Manager to manage public SSL/TLS certificates.

You have the following operational requirements:

Certificates must be fully provisioned, validated, and active prior to shifting public production traffic to prevent TLS handshake errors and downtime.
Domain ownership validation must support wildcard domains and domains whose live DNS A/AAAA records still point to legacy infrastructure.
Certificates and domain routing must scale dynamically beyond standard target proxy certificate limits and support automated zero-downtime renewals.

Which workflow should you implement in your automated deployment pipeline to satisfy these requirements?

Generate self-signed fallback certificates, attach them to the Target SSL Proxy, and configure a Cloud Run job in the CI/CD pipeline to query Let's Encrypt ACME APIs to upload and rotate renewed certificates via Secret Manager.

Create Certificate Manager DNS authorizations, publish the generated CNAME challenge records to the authoritative DNS provider, provision Google-managed certificates referencing these DNS authorizations, map the certificates to domain entries within a Certificate Map, and attach the Certificate Map to the target HTTPS proxy.

Create a global Certificate Map with fallback wildcards, attach the map to the forwarding rule, and configure Cloud DNS peering to automatically issue Google-managed certificates without external DNS records.

Create Load Balancer-managed certificates referencing HTTP authorizations, deploy a URL map path-matcher rule forwarding /.well-known/acme-challenge/ to a backend bucket, attach the certificates directly to the target HTTPS proxy, and shift DNS A records to trigger validation.

Professional Cloud DevOps Engineer

Certificate Manager Dns Authorization Map Workflow

Related questions