Skip to main content

Google Trust Services (ACME)

Automated issuance of DV certificates via ACME with External Account Binding, integrated with Google Cloud's Public Certificate Authority.

Requirements​

RequirementDetail
GCP projectActive Google Cloud project with billing enabled
Enabled APIpublicca.googleapis.com enabled on the project
IAM permissionRole with permission to create External Account Keys on the project
Directory URLhttps://dv.acme-v02.api.pki.goog/directory
EABRequired — single-use and expires in 7 days
CAA recordIf the domain has a published CAA record, it must include 0 issue "pki.goog"
Google's EAB is single-use and expires in 7 days

Unlike every other supported CA, Google's EAB credentials register only one ACME account and expire in 7 days if unused. Generate the credentials and complete the registration + first issuance back to back. If any attempt fails, generate a new EAB before trying again — never reuse the same one.

This only affects the moment of registration. Once registered, the ACME account works indefinitely and renewals no longer depend on the EAB.

Get the credentials in Google Cloud​

Credentials are generated with the gcloud CLI, in Cloud Shell or an authenticated local terminal.

1. Confirm the correct project​

gcloud projects list

Copy the full PROJECT_ID, not the number or a shortened version.

gcloud config set project YOUR-FULL-PROJECT-ID
gcloud config get-value project
Watch out for a truncated Project ID

Google project IDs often have a prefix (e.g. project-e67b6732-cf53-4c4d-8de). Using the version without the prefix points to a nonexistent project and produces PERMISSION_DENIED or RESOURCES_NOT_FOUND on the following commands. If the text ID causes trouble, use the project number, which is also accepted.

2. Enable the Public CA API​

gcloud services enable publicca.googleapis.com

If the API isn't enabled, the key creation command fails with PERMISSION_DENIED / CONSUMER_INVALID.

3. Generate the EAB​

gcloud publicca external-account-keys create

The output returns two values:

Field returned by gcloudUse in the CLM
keyIdEAB Key ID
b64MacKeyEAB HMAC Key
b64MacKey is the HMAC Key

Google uses the name b64MacKey for what the CLM calls the HMAC Key. It's the same value — copy it in full, without changes.

Treat it like a password

b64MacKey is an active credential for your organization at Google Trust Services. Don't share it, don't paste it into chats, tickets, or repositories. If it's exposed, generate a new pair immediately.

4. Don't use sudo su​

Switching users in Cloud Shell discards the gcloud configuration (root has its own config) and project goes back to (unset). Run the commands as the normally authenticated user.

Connect in the CLM​

Google Trust Services is registered through the generic ACME CA card.

  1. Go to Integrations in the sidebar menu
  2. On the Other CA (ACME) card, click Connect
  3. Fill in the Register account modal:
FieldDescription
NameIdentifier for the account in the CLM. Use a descriptive name, e.g. Google Trust Services — on accounts registered through the generic card, this name is what identifies the CA across the screens
EmailContact address
Directory URL (ACME)https://dv.acme-v02.api.pki.goog/directory
EAB Key IDThe keyId generated by gcloud
EAB HMAC KeyThe b64MacKey generated by gcloud
  1. Click Register
  2. Issue a certificate immediately after registering, for the reasons described above
The correct Directory URL is not pki.goog

https://pki.goog is Google's PKI institutional page, not the ACME endpoint. Entering it results in an allowlist block. The correct endpoint for DV certificates is https://dv.acme-v02.api.pki.goog/directory — note the dv. prefix and the /directory path.

Details​

Product-specific endpoint. The dv. at the start of the host indicates DV (Domain Validated) certificates, the standard use case. Google maintains distinct endpoints for other products, such as SXG certificates.

Account registered through the generic card. Since Google is registered via Other CA (ACME), the name you provide is what appears across the CLM's screens and reports. Choose a self-explanatory name.

Renewal doesn't depend on the EAB. After registration, the CLM uses the persisted ACME account key (stored encrypted) for all subsequent operations. The 7-day, single-use limitation doesn't affect renewals or revocations.

Trust hierarchy. Issued certificates chain to GTS Root R1, with intermediate WR1.

Common errors​

Unknown external account binding (EAB) key. This may be due to the EAB key expiring which occurs 7 days after creation.​

Cause: the EAB registered in the CLM is no longer valid — it expired (7 days), was already consumed in a previous registration, or a different credential from the last one generated was registered by mistake.

Solution:

  1. Generate a new EAB: gcloud publicca external-account-keys create
  2. Edit the integration in the CLM and replace the Key ID and HMAC Key with the new values
  3. Issue immediately

Account does not exist for this key. Please create a new account.​

Cause: the account in the CLM is in an intermediate state — it has a persisted account key from a previous attempt that didn't complete registration. The recovery flow queries Google, which responds that the key has no associated account.

Solution — clean restart:

  1. Delete the Google account in the CLM (this clears the residual state)
  2. Generate a new EAB in gcloud
  3. Register the account from scratch with the new credentials
  4. Issue right after, with no gap

Registering from scratch makes the CLM follow the clean registration path instead of the recovery path.

400: HOST_NOT_ALLOWED when saving the integration​

Cause: incorrect Directory URL — almost always https://pki.goog instead of the ACME endpoint.

Solution: use https://dv.acme-v02.api.pki.goog/directory.

PERMISSION_DENIED / RESOURCES_NOT_FOUND in gcloud​

Cause: incorrect project (truncated ID), publicca.googleapis.com API not enabled, or the account lacks IAM permission on the project.

Solution:

  1. gcloud projects list and copy the full PROJECT_ID
  2. gcloud config set project <full-ID> (or the project number)
  3. gcloud services enable publicca.googleapis.com
  4. If it persists, check with the project's administrator whether your account has permission to create External Account Keys

Edit​

Click the ⋮ menu on the card and select Edit. You can change the name, email, Directory URL, and replace the EAB credentials. The current HMAC Key is never shown — entering a new one replaces the previous one.

Delete​

Click the ⋮ menu on the card and select Delete. Unlink active certificates before removing the integration.

Deleting and re-registering is the recommended procedure when the account ends up in an inconsistent state after failed registration attempts.

External references​

Next step​

With the integration connected, see Issue with Google Trust Services (ACME).