Meta tags:
description=Set up backend mTLS to let both the load balancer and its backends mutually authenticate each other.;

Headings (most frequently used words):

global, regional, the, backend, create, certificate, console, gcloud, and, config, on, certificates, client, authentication, resource, to, server, set, up, mtls, stay, organized, with, collections, save, categorize, content, based, your, preferences, before, you, begin, permissions, setup, overview, root, intermediate, format, trust, attach, service, of, load, balancer, additional, ssl, configuration, options, an, apache, web, what, next, upload, manager, products, pricing, support, resources, engage,

Text of the page (most frequently used words):
the (398), #backend (148), certificate (129), load (121), and (97), config (85), resource (65), #balancer (61), client (60), create (57), trust (55), for (52), set (51), authentication (51), global (48), server (46), application (46), cloud (45), region (43), name (42), regional (42), balancers (41), with (38), service (38), overview (35), that (33), backends (33), you (32), certificates (32), root (32), following (31), file (31), yaml (30), external (29), configuration (28), key (27), google (26), this (26), mtls (25), internal (25), gcloud (24), cert (23), ssl (21), where (21), add (21), neg (21), use (20), csr (19), balancing (18), manager (18), instance (18), replace (17), example (17), click (17), group (17), intermediate (16), eof (16), location (16), created (15), private (15), req (15), cross (15), managed (15), section (14), cat (14), com (14), zonal (14), hybrid (14), using (13), services (13), target (13), openssl (12), backend_service_filename (12), compute (12), import (12), backend_auth_config_name (12), project_id (12), management (12), configure (11), your (11), attach (11), earlier (10), traffic (10), upload (10), int (10), extensions (10), examplepetstore (10), project (10), select (10), console (10), network (10), architecture (9), more (9), pem (9), encoded (9), out (9), 509 (9), signed (9), can (9), backend_service_name (9), command (9), sni (9), steps (9), self (9), negs (9), buckets (9), custom (9), other (8), apache (8), update (8), based (8), enable (8), https (8), extension_requirements (8), new (8), requirements (8), projects (8), locations (8), tls (8), backend_authentication_config_resource_filename (8), configs (8), trust_config_name (8), cnf (8), ca_exts (8), run (8), resources (7), see (7), thumb (7), are (7), api (7), which (7), from (7), store (7), storage (7), url (7), proxy (7), internet (7), capabilities (7), code (6), need (6), page (6), its (6), web (6), etc (6), specify (6), 2048 (6), critical (6), contains (6), specifies (6), source (6), flag (6), backendauthenticationconfigs (6), examples (6), export (6), list (6), security (6), scope (6), serverless (6), premises (6), shared (6), vpc (6), http (6), about (5), content (5), policies (5), optional (5), certs (5), copy (5), x509 (5), days (5), keyout (5), san (5), test (5), extendedkeyusage (5), learn (5), chain (5), anchor (5), only (5), complete (5), view (5), terraform (5), auth (5), label (5), stored (5), subj (5), forwarding (5), troubleshooting (5), metrics (5), tcp (5), redirect (5), português (4), español (4), sign (4), down (4), information (4), sudo (4), validate (4), sha256 (4), newkey (4), rsa (4), nodes (4), dn_requirements (4), keyusage (4), basicconstraints (4), distinguished_name (4), back (4), exported (4), networksecurity (4), dnsname (4), values (4), setup (4), configured (4), tab (4), authenticated (4), defined (4), client_certificate_name (4), trustconfigs (4), client_ (4), certificate_name (4), enter (4), contents (4), empty_distinguished_name (4), trust_config (4), format (4), sed (4), certificatemanager (4), connectivity (4), tools (4), maps (4), ipv6 (4), rules (4), logs (4), monitor (4), troubleshoot (4), headers (4), samples (3), updated (3), permissions (3), next (3), apache2 (3), over (3), additional (3), when (3), authenticate (3), cakey (3), extfile (3), dns (3), include (3), located (3), tlssettings (3), them (3), hostname (3), backendauthenticationconfig (3), verify (3), used (3), value (3), clientauth (3), 3650 (3), own (3), line (3), uses (3), identity (3), pemcertificate (3), step (3), infrastructure (3), request (3), engine (3), cli (3), guides (3), networking (3), health (3), frontend (3), explore (3), tutorials (3), connected (3), networks (3), directory (3), registration (3), distribution (3), udp (3), migrate (3), classic (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), third (2), manage (2), terms (2), site (2), youtube (2), started (2), support (2), pricing (2), all (2), products (2), understand (2), last (2), 2026 (2), utc (2), except (2), licensed (2), under (2), license (2), send (2), feedback (2), through (2), process (2), options (2), restart (2), sites (2), available (2), default (2), conf (2), require (2), specified (2), presents (2), itself (2), 365 (2), issue (2), false (2), nonrepudiation (2), digitalsignature (2), keyencipherment (2), serverauth (2), alt_names (2), california (2), francisco (2), organizationname (2), emailaddress (2), commonname (2), organizationalunitname (2), localityname (2), stateorprovincename (2), countryname (2), prompt (2), req_extensions (2), default_bits (2), generate (2), have (2), already (2), provides (2), part (2), authenticationconfig (2), googleapis (2), subjectaltnames (2), declaration (2), intended (2), substitute (2), real (2), world (2), relevant (2), attribute (2), accepted (2), sans (2), path (2), destination (2), note (2), advanced (2), configurations (2), edit (2), trustconfig (2), clientcertificate (2), wellknownroots (2), public_roots (2), public (2), appears (2), field (2), paste (2), choose (2), denotes (2), description (2), must (2), true (2), keycertsign (2), kept (2), empty (2), allow (2), setting (2), via (2), argument (2), mark (2), suitable (2), authority (2), pki (2), library (2), appropriate (2), needs (2), acts (2), before (2), intermediate_cert (2), root_cert (2), environment (2), variables (2), between (2), commands (2), skip (2), sections (2), follow (2), apis (2), instructions (2), references (2), review (2), also (2), documentation (2), sdk (2), languages (2), frameworks (2), costs (2), usage (2), access (2), observability (2), monitoring (2), migration (2), industry (2), solutions (2), distributed (2), multicloud (2), databases (2), data (2), analytics (2), pipelines (2), hosting (2), development (2), logging (2), pools (2), tags (2), checks (2), optimizations (2), authorization (2), workload (2), protocol (2), failover (2), multiple (2), protocols (2), concepts (2), pool (2), convert (2), capacity (2), routing (2), app (2), functions (2), error (2), constraints (2), product (2), reference (2), technology (2), areas (2), close (2), subscribe, newsletter, our, decade, climate, action, join, cookies, privacy, tech, twitter, events, blog, engage, training, certification, center, getting, github, system, status, release, notes, community, forums, contact, sales, marketplace, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, otherwise, noted, details, java, registered, trademark, oracle, affiliates, developers, creative, commons, attribution, lists, required, walks, what, systemctl, apply, changes, c_rehash, rehash, sslverifyclient, sslverifydepth, sslcacertificatefile, validation, sslcertificatefile, sslcertificatekeyfile, order, connects, completing, subjectaltname, option, leaf, ensures, established, pointing, addition, referred, settings, continue, checkbox, expand, declaratively, different, attributes, displayed, equivalent, roots, indicates, associate, than, one, needed, button, add_box, isn, protected, passphrase, type, helps, identify, specific, later, unique, issued, connecting, sets, indication, selects, expects, match, subject, alternative, listed, prove, carried, cannot, after, has, been, important, anchors, rows, intermediatecas, trustanchors, truststores, parameters, reads, previous, added, allowlist, intermediary, lets, another, level, represents, existing, into, single, they, referenced, set_serial, signing, top, cryptographically, receives, validates, establishing, jump, components, enlarge, describe, shown, diagram, backendservice, permission, operation, any, supported, enabling, haven, previously, first, init, want, guide, find, related, install, begin, both, consists, these, described, document, similar, known, attached, save, categorize, preferences, stay, organized, collections, home, clean, check, audit, operate, maintain, map, size, quota, units, proxies, subnets, endpoint, groups, names, firewall, connection, draining, customize, post, quantum, user, provided, mutual, encryption, secure, switch, deploy, hub, spoke, hop, common, address, party, appliances, hops, affinity, weighted, passthrough, testing, optimize, latency, deliver, same, published, domain, faster, performance, improved, protection, multi, best, practices, fail, high, availability, rewrite, header, query, parameter, roll, responses, response, bucket, organization, policy, iam, conditions, roles, get, feature, comparison, model, discover, start, free, main,

Text of the page (random words):
ld upload a pem encoded private key that isn t protected with a passphrase or copy and paste the contents of the pem encoded private key specify a label to associate to the certificate you can add more than one label if needed to add a label click the add_box add label button and specify a key and a value for your label click create verify that the new certificate appears in the list of certificates gcloud to upload the client certificate to certificate manager use the gcloud certificate manager certificates create command the scope of this certificate is client auth which indicates that this certificate is used as a client certificate in backend mtls global for global external application load balancers and cross region internal application load balancers create a global certificate manager certificate gcloud certificate manager certificates create client_ certificate_name certificate file client cert private key file client key scope client auth location global replace client_certificate_name with the name of the client certificate resource this client certificate with the scope client auth is used by the backend authentication config resource regional for regional external application load balancers and regional internal application load balancers create a regional certificate manager certificate gcloud certificate manager certificates create client_ certificate_name certificate file client cert private key file client key scope client auth location region replace the following client_certificate_name the name of the client certificate resource this client certificate with the scope client auth is used by the backend authentication config resource region the region where the certificate is to be created create a backend authentication config resource to create a backend authentication config backendauthenticationconfig resource complete the following steps console in the google cloud console go to the authentication configuration page go to authentication configuration on the backend authentication tab click create enter a name for the backend authentication config resource for location select global or regional select the client certificate resource that you created earlier optional select the public roots of trust select the trust config resource that you created earlier optional click equivalent code to view the terraform configuration for this resource click create verify that the backend authentication config resource is displayed gcloud create a yaml file that declaratively specifies the different attributes of the backend authentication config resource global for global external application load balancers and cross region internal application load balancers create a global backend authentication config resource attach the client certificate to the backend authentication config resource to enable backend mtls cat backend_authentication_config_resource_filename yaml name projects project_id locations global backendauthenticationconfigs backend_auth_config_name trustconfig projects project_id locations global trustconfigs trust_config_name clientcertificate projects project_id locations global certificates client_ certificate_name wellknownroots public_roots eof replace the following backend_authentication_config_resource_filename the name of the yaml file where the backend authentication config resource is defined project_id the id of your google cloud project backend_auth_config_name the name of the backend authentication config resource trust_config_name the name of the trust config resource that you created earlier client_certificate_name the name of the client certificate resource that you created earlier regional for regional external application load balancers and regional internal application load balancers create a regional backend authentication config resource attach the client certificate to the backend authentication config resource to enable backend mtls cat backend_authentication_config_resource_filename yaml name projects project_id locations region backendauthenticationconfigs backend_auth_config_name trustconfig projects project_id locations region trustconfigs trust_config_name clientcertificate projects project_id locations region certificates client_ certificate_name wellknownroots public_roots eof replace the following backend_authentication_config_resource_filename the name of the yaml file where the backend authentication config resource is defined project_id the id of your google cloud project region the name of the region backend_auth_config_name the name of the backend authentication config resource trust_config_name the name of the trust config resource that you created earlier client_certificate_name the name of the client certificate resource that you created earlier to import the backend authentication config use the gcloud network security backend authentication configs import command global for global external application load balancers and cross region internal application load balancers set the location flag to global gcloud network security backend authentication configs import backend_auth_config_name source backend_authentication_config_resource_filename yaml location global replace the following backend_auth_config_name the name of the backend authentication config resource backend_authentication_config_resource_filename the name of the yaml file where the backend authentication config resource is defined regional for regional external application load balancers and regional internal application load balancers set the location flag to the region where the load balancer is configured gcloud network security backend authentication configs import backend_auth_config_name source backend_authentication_config_resource_filename yaml location region replace the following backend_auth_config_name the name of the backend authentication config resource backend_authentication_config_resource_filename the name of the yaml file where the backend authentication config resource is defined region the region where the load balancer is configured attach the backend authentication config resource to the backend service of the load balancer to attach the backend authentication config backendauthenticationconfig resource to the backend service of the load balancer complete the following steps console in the google cloud console go to the load balancing page go to load balancing on the backends tab select the backend service for which you need to enable backend authenticated tls and backend mtls click edit edit expand the advanced configurations section in the backend authentication section select the enable checkbox optional specify the sni hostname and accepted sans to validate the backend certificate to attach the backend authentication config resource to the backend service in the backend authentication config list select the backend authentication config resource click continue to update the backend service settings click update gcloud to list all the backend service resources in your project use the gcloud compute backend services list command gcloud compute backend services list note the name of the backend service to attach the backendauthenticationconfig resource to this name is referred to as backend_service_name in the following steps to export the backend service configuration to a file use the gcloud compute backend services export command global for global external application load balancers and cross region internal application load balancers set the location flag to global gcloud compute backend services export backend_service_name destination backend_service_filename yaml global replace the following backend_service_name the name of the backend service backend_service_filename the name and path to a yaml file where the backend service configuration is exported regional for regional external application load balancers and regional internal application load balancers set the location flag to the region where the load balancer is configured gcloud compute backend services export backend_service_name destination backend_service_filename yaml region region replace the following backend_service_name the name of the backend service backend_service_filename the name and path to a yaml file where the backend service configuration is exported region the name of the google cloud region where the backend service is located update the tlssettings attribute of the backend service pointing it to the backend authentication config resource in addition you can configure the sni hostname and accepted sans on the backend service to validate the backend certificate global for global external application load balancers and cross region internal application load balancers attach the global backend authentication config resource to the backend service the sni and san values in the following yaml declaration are intended as examples only you can substitute them with real world values that are relevant to your setup cat eof backend_service_filename yaml tlssettings authenticationconfig networksecurity googleapis com projects project_id locations global backendauthenticationconfigs backend_auth_config_name sni examplepetstore com subjectaltnames dnsname examplepetstore com dnsname api examplepetstore com eof replace the following backend_service_filename the name of the yaml file where the backend service configuration is exported project_id the id of your google cloud project backend_auth_config_name the name of the backend authentication config resource regional for regional external application load balancers and regional internal application load balancers attach the regional backend authentication config resource to the backend service the sni and san values in the following yaml declaration are intended as examples only you can substitute them with real world values that are relevant to your setup cat eof backend_service_filename yaml tlssettings authenticationconfig networksecurity googleapis com projects project_id locations region backendauthenticationconfigs backend_auth_config_name sni examplepetstore com subjectaltnames dnsname examplepetstore com dnsname api examplepetstore com eof replace the following backend_service_filename the name of the yaml file where the backend service configuration is exported project_id the id of your google cloud project region the name of the google cloud region where the backend authentication config is created backend_auth_config_name the name of the backend authentication config resource to import the updated backend service configuration from a file use the gcloud compute backend services import command global for global external application load balancers and cross region internal application load balancers use the global flag gcloud compute backend services import backend_service_name source backend_service_filename yaml global replace the following backend_service_name the name of the backend service backend_service_filename the name of the backend service configuration yaml file regional for regional external application load balancers and regional internal application load balancers set the region flag to the region where the load balancer is located gcloud compute backend services import backend_service_name source backend_service_filename yaml region region replace the following backend_service_name the name of the backend service backend_service_filename the name of the backend service configuration yaml file region the name of the google cloud region where the backend service is located create a backend server certificate this section provides an additional configuration option to create a server leaf certificate that is signed by the intermediate certificate which is a part of the trust config this ensures that a chain of trust can be established from the server certificate back to the trust anchor if you have already created a trust config resource that contains an intermediate certificate do the following create a configuration file to generate the csr for the server certificate the following configuration file server config contains the extension_requirements section which specifies the x 509 extensions to include in the csr to learn more about the requirements for server certificates see certificate requirements cat server config eof req default_bits 2048 req_extensions extension_requirements distinguished_name dn_requirements prompt no extension_requirements basicconstraints critical ca false keyusage critical nonrepudiation digitalsignature keyencipherment extendedkeyusage serverauth subjectaltname alt_names alt_names dns 1 examplepetstore com dns 2 api examplepetstore com dn_requirements countryname us stateorprovincename california localityname san francisco 0 organizationname example organizationalunitname test commonname examplepetstore com emailaddress test examplepetstore com eof create the csr server csr for the server certificate openssl req new sha256 newkey rsa 2048 nodes config server config keyout server key out server csr sign the csr to issue the x 509 server certificate server cert the csr is signed by the intermediate certificate openssl x509 req cakey int key ca int cert days 365 extfile server config extensions extension_requirements in server csr out server cert when the load balancer connects to the backend server the backend server presents its certificate server cert to authenticate itself to the load balancer completing the backend authentication process additional ssl configuration options on an apache web server this optional section walks you through the process to update the ssl configuration options on an apache server based on the client and server certificates that you created earlier copy the server private key server key and server certificate server cert over to the apache web server cat server key replace with the pem encoded server private key that you created earlier cat server cert replace with the pem encoded server certificate that you created earlier upload the client certificate to the server s trust config in order to validate the client certificate cat client cert replace with the pem encoded client certificate that you created earlier update the ssl configuration of the apache web server update apache s ssl configuration to enable https traffic using the specified ssl certificate and private key sudo vi etc apache2 sites available default ssl conf sslcertificatefile etc ssl certs server cert sslcertificatekeyfile etc ssl private server key update apache s ssl configuration to require client certificate authentication and specify the ca certificate for validation sudo vi etc apache2 sites available default ssl conf sslverifyclient require sslverifydepth 5 sslcacertificatefile etc ssl certs client cert rehash the ca certificates sudo c_rehash etc ssl certs restart the apache web server to apply the changes sudo systemctl restart apache2 service what s next mtls overview set up mtls with a priv...