GCP Certificate-Manager global Certificate-Map global certificate : "invalid scope"

Google Cloud Compute Infrastructure
, ,
1

I have a GCP project with :

  • a global (“scope: ALL_REGIONS”) active existing Google-managed certificate (listed as “Certificate” not “classicCertificate”)
  • an existing global certificate map

when adding the cert into the certificate map, I receive error :

ERROR: (gcloud.certificate-manager.maps.entries.create) INVALID_ARGUMENT: certificate “projects/200020001113/locations/global/certificates/cert-dev-global” has invalid scope

I don’t understand as it should match (both are “global”). Any help ?

1 Like
2

Hi @nalb ,

Welcome to Google Cloud Community!

While both are labeled as “global,” Google-managed certificates (listed as “Certificate” rather than “classicCertificate”) are currently region-specific, even when set to ALL_REGIONS. If the certificate is Google-managed, it may not be compatible with a global certificate map.

Alternative Solution:

  • Create a Regional Certificate Map:
    If the certificate is Google-managed, it must be mapped to a regional certificate map instead of a global one. Try creating a regional certificate map and adding the certificate there:
    gcloud certificate-manager maps create my-regional-map --location=<REGION

Then, add the certificate to the newly created map.

  • Or Use Classic Certificates:
    If you require a truly global certificate, consider creating a classicCertificate instead.

Certificate maps are not supported by cross-region internal Application Load Balancers. After you create the Google-managed certificate, attach the certificate directly to the target proxy.

Other References: Certificate Manager Limitations, GCP Public Tracker: Certificate Manager does not support --scope=“all-regions”

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

3

Just use the Default scope when creating the certificate