Add Google Trust Services

Google Trust Services issues publicly-trusted certificates through ACME, but requires an External Account Binding (EAB) key pair before it will let an ACME client register - this guide creates that key pair and connects it.

1. Create an EAB key pair in Google Cloud

  1. Sign in to the Google Cloud Console and select (or create) the project you want to issue certificates under.
  2. Enable the Public Certificate Authority API for that project, if it isn't already enabled.
  3. Go to Certificate Manager > Public CA in the left navigation.
  4. Open the External account bindings tab and click Create external account key.
  5. Copy the Key ID and Base64 MAC key shown - the MAC key is only displayed once.

2. Connect it in aethercert

  1. Go to Manage > Certificate Authorities and click Add certificate authority.
  2. Set Type to ACME CA (public or internal).
  3. Set Provider to Google Trust Services (Production) - this fills in the correct ACME directory URL automatically. Use the Staging/Test preset instead while you're still verifying the setup, to avoid burning production issuance attempts.
  4. Paste the Key ID into EAB key ID.
  5. Paste the Base64 MAC key into EAB HMAC key.
  6. Name it something recognizable (e.g. "Google Trust Services") and save.

3. Use it

Pick this CA when creating a certificate under Build > Certificate Jobs. Google Trust Services supports wildcard certificates and up to 100 SANs per certificate - for wildcards, make sure the certificate's domain has a DNS provider connected, since wildcard issuance requires DNS-01.