With Google Trust Services (ACME)
Issuance of certificates through Google Trust Services using ACME, with automatic domain validation.
The Google Trust Services (ACME) integration must be registered through the Other CA (ACME) card — see Integrations → Google Trust Services (ACME). The full wizard walkthrough is in Issuance flow.
Requirements
| Requirement | Detail |
|---|---|
| Registered integration | Google Trust Services ACME account registered under Integrations, through the generic card |
| EAB still valid | Single-use and expires in 7 days — only relevant for registration and the first issuance |
| CAA record | If published, must include 0 issue "pki.goog" |
| Key | RSA — 2048, 3072, or 4096 bits |
The CLM only registers the account with Google on the first issuance, and the EAB used at registration expires in 7 days. If the first issuance is delayed, the EAB may expire beforehand — generate a new pair in gcloud and update the integration if that happens.
What changes in Step 2
Under Certificate Authority, select the registered Google Trust Services account (the name is whatever you entered at registration, e.g. Google Trust Services). The form shows:
- ACME Account — select the registered account
- Validation Method — HTTP Challenge or DNS Challenge
- DNS Auto-Validation (AWS Route 53) — available when choosing DNS Challenge
After issuance
Google Trust Services issues short-lived DV certificates, chained to GTS Root R1. The CLM's automatic renewal no longer depends on the EAB used at registration — it uses the persisted ACME account key.
Common issues
| Error | Likely cause |
|---|---|
Unknown external account binding (EAB) key | EAB expired (7 days) or already consumed — generate a new pair and update the integration |
Account does not exist for this key | Account in an intermediate state — delete the integration, generate a new EAB, and register from scratch |
| CAA rejected | CAA record doesn't authorize pki.goog |
| HTTP-01 challenge expired | Port 80 blocked or redirecting — use DNS Challenge |
For the credential generation walkthrough in gcloud and more details on each error, see Integrations → Google Trust Services (ACME).