Use SSL policies for SSL and TLS protocols

Console

Regional SSL policy

To create a regional SSL policy with a Google-managed profile, do the following:

1. In the Trusted Cloud console, go to the SSL policies page.

   Go to SSL policies

2. Click Create policy.

3. For Regional SSL policy, click the Create button next to it. The Create policy page appears.

4. Enter a Name.

5. Select a Region.

6. Select a Minimum TLS Version.

7. For Profile, select Compatible, Modern, or Restricted. The Enabled features and Disabled features for the profile are displayed on the right side of the page.

8. If there is a load balancer to which you want to attach the policy, click Apply to targets and select a forwarding rule as the target of the SSL policy. If necessary, add more targets.

9. Click Create.

gcloud

Regional SSL policy

The following is the general syntax for creating a regional SSL policy with a Google-managed profile:

gcloud compute ssl-policies create SSL_POLICY_NAME \
    --profile COMPATIBLE | MODERN | RESTRICTED \
    --min-tls-version 1.0 | 1.1 | 1.2 \
    --region REGION

The following command creates a regional SSL policy with the COMPATIBLE profile:

gcloud compute ssl-policies create my-ssl-policy \
    --profile COMPATIBLE \
    --min-tls-version 1.1 \
    --region us-west1

Console

Regional SSL policy

To create a regional SSL policy with a custom profile, do the following:

1. In the Trusted Cloud console, go to the SSL policies page.

   Go to SSL policies

2. Click Create policy.

3. For Regional SSL policy, click the Create button next to it. The Create policy page appears.

4. Enter a Name.

5. Select a Region.

6. Select a Minimum TLS Version.

7. For Profile, select Custom. All features are shown as Disabled features on the right side of the page.

8. In the list of Features, select each cipher suite that you want to enable. The cipher suites you enable are listed as Enabled features.

9. If there is a load balancer to which you want to attach the policy, click Apply to targets and select a forwarding rule as the target of the SSL policy. If necessary, add more targets.

10. Click Create.

gcloud

When you create an SSL policy with the CUSTOM profile, only the features that you specify in the create command are supported. Other features are not supported.

Regional SSL policy

The following is the general syntax for creating a regional SSL policy with a custom profile:

gcloud compute ssl-policies create SSL_POLICY_NAME \
    --profile CUSTOM \
    --min-tls-version 1.0 | 1.1 | 1.2 \
    --custom-features SSL_FEATURE_1[,SSL_FEATURE_2,SSL_FEATURE_3] \
    --region REGION

The following example creates a regional SSL policy with the CUSTOM profile with a minimum TLS version of 1.2 and features TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.

gcloud compute ssl-policies create SSL_POLICY_NAME \
    --profile CUSTOM \
    --min-tls-version 1.2 \
    --custom-features TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 \
    --region us-west1

Console

In the Trusted Cloud console, go to the SSL policies page.

Go to SSL policies

You can view a list of all the available SSL policies. The Scope field indicates whether the SSL policy is global or regional.

gcloud

To list only regional SSL policies, run:

  gcloud compute ssl-policies list --regions REGION

Console

1. In the Trusted Cloud console, go to the SSL policies page.

   Go to SSL policies

2. Click the name of the policy whose features you want to see. The enabled and disabled cipher suites are listed on the right side of the page.

gcloud

To list the features available in regional SSL policies:

gcloud compute ssl-policies list-available-features \
    --region REGION

Console

To modify a regional SSL policy, do the following:

1. In the Trusted Cloud console, go to the SSL policies page.

   Go to SSL policies

2. Click the name of the policy that you want to modify.

3. Click Edit.

4. Make any changes you want.

5. Click Save.

gcloud

To modify an existing SSL policy, pass any or all of the flags corresponding to the fields you want to update. Unspecified fields are not updated.

If you update the features, previously enabled features are deleted and replaced with the new features you specify.

Regional SSL policies

gcloud compute ssl-policies update SSL_POLICY_NAME \
    --profile COMPATIBLE|MODERN|RESTRICTED|CUSTOM \
    --min-tls-version 1.0|1.1|1.2 \
    [--custom-features FEATURES \]
    --region REGION

Console

You can create a target proxy by using the Trusted Cloud console when you're creating or updating the load balancer as shown in the following documents:

• Set up a regional external Application Load Balancer
• Set up a regional internal Application Load Balancer

gcloud

To create a regional target HTTPS proxy with a regional SSL policy:

gcloud compute target-https-proxies create REGIONAL_TARGET_HTTPS_PROXY_NAME \
  --ssl-certificates SSL_CERTIFICATE_NAME \
  --url-map URL_MAP_NAME \
  --url-map-region REGION \
  --ssl-policy SSL_POLICY_NAME \
  --region REGION

Console

gcloud

Use these commands to attach an existing SSL policy to an HTTPS proxy.

• To find all projects in your organization that have target HTTPS proxies:

  gcloud asset search-all-resources \
      --scope=organizations/ORGANIZATION_ID \
      --asset-types=compute.googleapis.com/TargetHttpsProxy
  

• To list all regional target HTTPS proxies in a project, use the targetHttpsProxies.aggregatedList method with the includeAllScopes query parameter set to true. Then, use the filter query parameter to search for target HTTPS proxies that don't reference an SSL policy.

  curl \
      'https://compute.s3nsapis.fr/compute/v1/projects/PROJECT_ID/aggregated/targetHttpsProxies?filter=sslPolicy%3D%22%22&includeAllScopes=true&key=YOUR_API_KEY' \
      --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
      --header 'Accept: application/json' \
      --compressed
  

• To attach an existing regional SSL policy to a regional target HTTPS proxy:

  gcloud compute target-https-proxies update REGIONAL_TARGET_HTTPS_PROXY_NAME \
      --ssl-policy SSL_POLICY_NAME \
      --region REGION
  

If you don't provide the --ssl-policy flag or the --clear-ssl-policy flag in a target proxy update (for example, when updating an SSL certificate), the SSL policy is unchanged. The --clear-ssl-policy flag is described in Delete an SSL policy from a target proxy.

API

To set a regional SSL policy for a regional target proxy, use the regionTargetHttpsProxies.patch method.

Console

gcloud

Use these commands to remove an SSL policy from an HTTPS proxy. If you don't attach a different SSL policy to the target proxy, the load balancer uses the default SSL policy. Using the --clear-ssl-policy flag is equivalent to replacing an SSL policy with the default SSL policy.

To remove a regional SSL policy from a regional target HTTPS proxy:

gcloud compute target-https-proxies update REGIONAL_TARGET_HTTPS_PROXY_NAME \
    --clear-ssl-policy \
    --region REGION

When you provide the --clear-ssl-policy flag in the update command, the SSL policy is removed from the proxy.

If you don't provide the --clear-ssl-policy flag or the--ssl-policy flag in the target proxy update (for example, when updating an SSL certificate), the SSL policy is unchanged. The --ssl-policy flag is described in Attach an existing SSL policy to an existing target proxy.