Question

Your company runs a global external Application Load Balancer serving traffic for three domains: www.example.com, shop.example.com, and api.example.com. Currently you manage separate self-signed certificates that require manual renewal, causing occasional outages when they expire. You want Google to automatically provision and renew certificates for all three domains with the least operational overhead. What should you do?

Accepted Answer

Create a single Google-managed SSL certificate that lists all three domains as subject alternative names and attach it to the load balancer's target HTTPS proxy.

Answer

Upload a wildcard self-managed certificate for *.example.com and configure a Cloud Scheduler job to rotate it every 60 days.

Answer

Create three separate Google-managed certificates and attach only the www.example.com certificate to the target HTTPS proxy, relying on SNI for the others.

Answer

Enable Cloud CDN with signed URLs so that TLS termination and certificate renewal are handled automatically at the edge.