Question

A financial services company exposes a partner-facing API through a global external Application Load Balancer. Regulatory requirements mandate that only clients presenting a valid X.509 certificate issued by the company's internal certificate authority may establish a connection to the load balancer. The security team must reject any client that does not present a trusted certificate at the TLS layer, before the request reaches the backend. Which approach meets this requirement?

Accepted Answer

Configure mutual TLS (mTLS) on the load balancer by creating a TrustConfig in Certificate Manager referencing the CA's trust anchor, then attach a server TLS policy that enforces client certificate validation.

Answer

Deploy a Cloud Armor security policy with a rule that inspects the client certificate header and denies requests lacking a valid certificate fingerprint.

Answer

Enable Google-managed SSL certificates on the load balancer frontend and require clients to trust the Google CA chain for the handshake.

Answer

Configure an SSL policy with a minimum TLS version of 1.3 and the RESTRICTED profile so that only clients with valid certificates can negotiate the handshake.