简体繁体 English

如何为 Google Cloud 负载均衡器设置 Letsencrypt？

[英]How to setup Letsencrypt for Google Cloud load balancer?

原文 2021-01-04 15:25:37 2 2 ssl/ google-compute-engine/ certbot

I've setup my Google Cloud Project to use a load balancer in combination with auto scaling instance templates.我已将我的 Google Cloud 项目设置为将负载均衡器与自动缩放实例模板结合使用。 Currently the instance group only has one instance.目前实例组只有一个实例。

My domain name successfully refers to the load balancers IP.我的域名成功引用了负载均衡器 IP。 Till these steps everything is working correctly.直到这些步骤一切正常。

Now I want to setup SSL for this project.现在我想为这个项目设置 SSL。 I would like to do this with the Letsencrypt service, however I'm having no success when trying to set this up.我想用 Letsencrypt 服务来做这件事，但是我在尝试设置它时没有成功。

In the Google Cloud Engine load balancer window there is an option to setup an earlier created certificate with Google Cloud shell to the load balancer frontend.在 Google Cloud Engine 负载平衡器 window 中，有一个选项可以使用 Google Cloud shell 将早期创建的证书设置到负载平衡器前端。 Unfortunately I can only create a.csr and.key file with the Google Cloud Shell.不幸的是，我只能使用 Google Cloud Shell 创建一个 .csr 和 .key 文件。 Furthermore, I can create an unsafe ssl certificate and get the.cert file from it, but I would like to create a safe SSL cert file using letsencrypt.此外，我可以创建一个不安全的 ssl 证书并从中获取 .cert 文件，但我想使用letsencrypt创建一个安全的 SSL 证书文件。 The Letsencrypt services requires direct access to the domain from to command line interface the commando was executed on, this is probably the reason why I'm getting an error indicating the domain name cannot be retrieved. Letsencrypt 服务需要从执行突击队的命令行界面直接访问域，这可能是我收到指示无法检索域名的错误的原因。

I'm looking for a way to install the Letsencrypt certificate on the loadbalancer using Google Cloud.我正在寻找一种使用 Google Cloud 在负载均衡器上安装 Letsencrypt 证书的方法。 Is there a way how I can manually create a.cert file with letsencrypt instead of installing this directly?有没有办法我可以使用letsencrypt手动创建一个.cert文件而不是直接安装它？ If not is there another way or service to create a.cert file from a.csr and.key file?如果没有，还有其他方法或服务可以从 .csr 和 .key 文件创建 .cert 文件吗？

2 个解决方案

Since GCP allow to use self-managed SSL certificates , you should be able to use SSL certificate or generate one in order to protect your site ans make it secure for visitors.由于 GCP 允许使用自我管理的 SSL 证书，您应该能够使用 SSL 证书或生成一个证书以保护您的网站并使其对访问者安全。 Is the same use as letsencrypt, because is free and it easier to use a Google Managed SSL certificate.与 Letsencrypt 的用途相同，因为它是免费的，并且更容易使用 Google Managed SSL 证书。

Review the following guidance and let me know your comments.查看以下指南，让我知道您的意见。 Happy new year.新年快乐。

The solution to this problem is this docker container https://hub.docker.com/r/bloomapi/letsencrypt-gcloud-balancer .这个问题的解决方案是这个 docker 容器https://hub.docker.com/r/bloomapi/letsencrypt-gcloud-balancer 。 You just need to create any virtual machine and give it full access to the API.您只需要创建任何虚拟机并为其授予对 API 的完全访问权限。 After that, install docker on it and run the docker container.之后，在其上安装 docker 并运行 docker 容器。 The certificates on the load balancer will automatically renew every month!负载均衡器上的证书将每月自动更新！