A TLS certificate turns http into https and shows the padlock in the browser. If your load balancer serves HTTPS, it needs one.
What you need
Two things, kept together: the certificate itself (usually with its intermediate chain) and its private key. Get a certificate for your domain from any certificate authority first.
Add it
- Open Networking, then TLS Certificates, and add a certificate.
- Fill in:
- Name: for example
www-cert. - Certificate: paste the certificate, followed by any intermediate/chain certificates.
- Private Key: paste the matching private key.
- Name: for example
- Save it. The key is stored securely by the platform's secrets service.
Use it
When you create an HTTPS listener on your load balancer, select this certificate. The load balancer then handles encryption, so your backend servers can speak plain HTTP internally while visitors get a secure connection.
Track the expiry date and replace the certificate before it lapses, or visitors will see security warnings.