canonical: https://jentic.com/apis/googleapis.com/certificatemanager

# Google Certificate Manager API

Google Cloud Certificate Manager API provisions, stores, and deploys TLS certificates and private trust configurations across Google Cloud load balancers and edge services. It supports Google-managed and self-managed certificates, certificate maps that route SNI-based hostnames to specific certificates, certificate issuance configurations for Certificate Authority Service, and trust configs that pin private CAs. Operations teams use it to automate certificate lifecycle and avoid manual rotation across global load balancer fleets.

## For AI agents

Provision and rotate TLS certificates, manage certificate maps and trust configs, and operate Google-managed or self-managed certs across Google Cloud load balancers.

## Scope

Does not issue private CAs, manage DNS records, or terminate TLS at the application layer - use for managing TLS certificates and trust configs on Google Cloud load balancers only.

## Capabilities

- Provision Google-managed TLS certificates that auto-renew before expiry
- Upload and rotate self-managed TLS certificates with their private keys
- Build certificate maps that bind hostnames to specific certificates via SNI
- Configure certificate issuance configs that source certs from a Certificate Authority Service CA pool
- Define trust configs that pin private root and intermediate CAs for mTLS workloads
- Track long-running operations and cancel them mid-flight when needed

## Use cases

### Automated TLS Rotation for Global Load Balancers

Platform teams replace manual certificate uploads with Google-managed certificates that auto-renew, then attach them to global external HTTPS load balancers via certificate maps. The API orchestrates provisioning, validation, and binding so that hostnames behind a single load balancer can each carry their own certificate. Rotation requires no traffic switch and no downtime.

Example prompt: Create a Google-managed Certificate resource for example.com via POST /v1/{parent}/certificates and bind it through a certificate map entry.

### mTLS with Pinned Private CAs

Security engineers configure trust configs that pin specific private root and intermediate CAs, then attach them to load balancers that require client certificates. This enables zero-trust mutual TLS for service-to-service traffic without trusting the public web PKI. Trust configs are versioned and updated atomically.

Example prompt: Create a TrustConfig under /v1/{parent}/trustConfigs containing the customer's private root CA PEM and intermediate CA chain.

### Multi-Hostname SNI Routing

SaaS providers serve hundreds of customer domains behind a single global IP using certificate maps and certificate map entries. Each entry binds an SNI hostname to a specific certificate, and entries can be added or removed without recreating the map. Onboarding a new customer domain is a single POST.

Example prompt: Create a certificate map entry binding hostname customer1.app.example.com to a previously provisioned certificate via POST /v1/{parent}/certificateMapEntries.

### AI Agent Certificate Operator via Jentic

An AI agent through Jentic responds to a user request to issue a certificate for a new hostname, runs the provisioning operation, polls until status is ACTIVE, and binds it to the relevant certificate map. Jentic isolates the Google Cloud OAuth credentials so the agent never sees the service account key directly. The whole flow runs through three Jentic calls.

Example prompt: Through Jentic, search certificatemanager_create_certificate, load schema, and execute with project, location, and a managed certificate config for hostname app.example.com.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /v1/{+parent}/certificates | Create a managed or self-managed TLS certificate |
| GET | /v1/{+parent}/certificates | List certificates in a location |
| POST | /v1/{+parent}/certificateMaps | Create a certificate map for SNI routing |
| POST | /v1/{+parent}/certificateMapEntries | Bind a hostname to a certificate within a map |
| POST | /v1/{+parent}/trustConfigs | Create a trust config pinning private CAs |
| POST | /v1/{+name}:cancel | Cancel a long-running operation |

## Key resources

- **Certificates** — Create, list, get, patch, and delete TLS certificates
- **Certificate Maps** — Manage SNI routing maps that bind hostnames to certificates
- **Certificate Map Entries** — Create and remove individual hostname-to-certificate bindings
- **Certificate Issuance Configs** — Configure issuance from a Certificate Authority Service CA pool
- **Trust Configs** — Pin private root and intermediate CAs for mTLS
- **Operations** — Track and cancel long-running asynchronous operations

## Why Jentic

- **Setup:** Wiring the Certificate Manager API by hand means setting up Google Cloud service account auth, minting scoped access tokens, and driving certificate, map, and trust-config calls through the long-running operations model yourself. Through Jentic you install once, import the Certificate Manager API from the API Directory, store the service account credential once, and your agent calls it.
- **Permission scoping:** The API puts the project and resource in the URL path (/v1/{+parent}/certificates, /v1/{+name}:cancel), so a rule can pin your agent to one project: it can create certificates, maps, and trust configs there and nowhere else. You choose the operations it may call, so canceling or deleting a resource is not included unless you add it.
- **Credential handling:** Your Google Cloud service account key is stored once, encrypted, by your own Jentic One instance and injected at execution time. The agent receives only short-lived scoped access tokens and the service account JSON never enters its prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'provision a TLS certificate for example.com on Google Cloud', and Jentic returns the certificates create operation with its full input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Cloud KMS API** — Manage cryptographic keys that may sign or wrap certificate private keys.
- **Cloud DNS API** — Manage the DNS records that prove domain ownership for managed certificate issuance.
- **Google Cloud IAM API** — Grant and revoke roles such as roles/certificatemanager.editor on certificate resources.

## FAQ

### What authentication does the Certificate Manager API use?

It requires OAuth 2.0 with the cloud-platform scope, typically via a Google Cloud service account key. Through Jentic, that service account credential lives in your Jentic One instance and the agent receives only short-lived access tokens scoped to the request.

### Can I provision a Google-managed TLS certificate via the API?

Yes. POST a Certificate resource to /v1/{parent}/certificates with managed.domains set to the hostnames to cover. The provisioning is asynchronous; poll the returned operation under /v1/{+name}/operations until done is true and the certificate state is ACTIVE.

### What are the rate limits for the Certificate Manager API?

Google Cloud applies per-project per-minute quotas (typically 60 write operations per minute and higher read quotas). Long-running operations such as managed certificate issuance can take several minutes to reach ACTIVE due to domain validation, not API throttling.

### How do I create a certificate map entry through Jentic?

Use the Jentic search query "create a certificate map entry" to discover the certificateMaps.certificateMapEntries.create operation, load its schema, then execute it with the parent map, the hostname, and the certificate resource name. Run pip install jentic to get started.

### Does the Certificate Manager API support self-managed certificates?

Yes. Provide selfManaged.pemCertificate and selfManaged.pemPrivateKey when creating a Certificate resource. Self-managed certificates do not auto-renew - the caller must rotate them by patching or replacing the resource before expiry.

### Is the Certificate Manager API free?

API calls themselves are free. Google Cloud charges for active certificates and trust configs based on the load balancer pricing tier they are attached to. See the Google Cloud Certificate Manager pricing page for current rates.

### Can I limit what my agent is allowed to do with the Google Cloud Certificate Manager API?

Yes. Because you self-host Jentic One, your own rules decide which Certificate Manager operations and credentials the agent may use. Since the API puts the project and resource in the URL path (for example /v1/{+parent}/certificates and /v1/{+name}:cancel), you can pin the agent to a single project and allow only the operations you choose, such as creating certificates, certificate maps, and trust configs. Destructive calls like canceling a long-running operation or deleting a certificate stay excluded unless you explicitly add them.