Google Certificate Manager API
Browse all Google APIs✓ Official Vendor SpecSecuritySecrets Managementoauth218 EndpointsREST
For Agents
Provision and rotate TLS certificates, manage certificate maps and trust configs, and operate Google-managed or self-managed certs across Google Cloud load balancers.
Use for: Provision a Google-managed TLS certificate for example.com, Upload a self-managed certificate and private key, List all certificates in a Google Cloud project location, Create a certificate map entry binding a hostname to a certificate
Not supported: Does not issue private CAs, manage DNS records, or terminate TLS at the application layer — use for managing TLS certificates and trust configs on Google Cloud load balancers only.
Google Cloud Certificate Manager API provisions, stores, and deploys TLS certificates and private trust configurations across Google Cloud load balancers and edge services. It supports Google-managed and self-managed certificates, certificate maps that route SNI-based hostnames to specific certificates, certificate issuance configurations for Certificate Authority Service, and trust configs that pin private CAs. Operations teams use it to automate certificate lifecycle and avoid manual rotation across global load balancer fleets.
Install Jentic One Beta
Connect the Certificate Manager API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Certificate Manager API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Certificate Manager API.
Provision Google-managed TLS certificates that auto-renew before expiry
Upload and rotate self-managed TLS certificates with their private keys
Build certificate maps that bind hostnames to specific certificates via SNI
Configure certificate issuance configs that source certs from a Certificate Authority Service CA pool
Define trust configs that pin private root and intermediate CAs for mTLS workloads
Track long-running operations and cancel them mid-flight when needed
Use Cases
Patterns agents use Certificate Manager API for, with concrete tasks.
★ Automated TLS Rotation for Global Load Balancers
Platform teams replace manual certificate uploads with Google-managed certificates that auto-renew, then attach them to global external HTTPS load balancers via certificate maps. The API orchestrates provisioning, validation, and binding so that hostnames behind a single load balancer can each carry their own certificate. Rotation requires no traffic switch and no downtime.
Create a Google-managed Certificate resource for example.com via POST /v1/{parent}/certificates and bind it through a certificate map entry.
mTLS with Pinned Private CAs
Security engineers configure trust configs that pin specific private root and intermediate CAs, then attach them to load balancers that require client certificates. This enables zero-trust mutual TLS for service-to-service traffic without trusting the public web PKI. Trust configs are versioned and updated atomically.
Create a TrustConfig under /v1/{parent}/trustConfigs containing the customer's private root CA PEM and intermediate CA chain.
Multi-Hostname SNI Routing
SaaS providers serve hundreds of customer domains behind a single global IP using certificate maps and certificate map entries. Each entry binds an SNI hostname to a specific certificate, and entries can be added or removed without recreating the map. Onboarding a new customer domain is a single POST.
Create a certificate map entry binding hostname customer1.app.example.com to a previously provisioned certificate via POST /v1/{parent}/certificateMapEntries.
AI Agent Certificate Operator via Jentic
An AI agent through Jentic responds to a user request to issue a certificate for a new hostname, runs the provisioning operation, polls until status is ACTIVE, and binds it to the relevant certificate map. Jentic isolates the Google Cloud OAuth credentials so the agent never sees the service account key directly. The whole flow runs through three Jentic calls.
Through Jentic, search certificatemanager_create_certificate, load schema, and execute with project, location, and a managed certificate config for hostname app.example.com.
Key Endpoints
18 endpoints — google cloud certificate manager api provisions, stores, and deploys tls certificates and private trust configurations across google cloud load balancers and edge services.
METHOD
PATH
DESCRIPTION
POST
/v1/{+parent}/certificates
Create a managed or self-managed TLS certificate
GET
/v1/{+parent}/certificates
List certificates in a location
POST
/v1/{+parent}/certificateMaps
Create a certificate map for SNI routing
POST
/v1/{+parent}/certificateMapEntries
Bind a hostname to a certificate within a map
POST
/v1/{+parent}/trustConfigs
Create a trust config pinning private CAs
POST
/v1/{+name}:cancel
Cancel a long-running operation
POST
/v1/{+parent}/certificates
Create a managed or self-managed TLS certificate
GET
/v1/{+parent}/certificates
List certificates in a location
POST
/v1/{+parent}/certificateMaps
Create a certificate map for SNI routing
POST
/v1/{+parent}/certificateMapEntries
Bind a hostname to a certificate within a map
POST
/v1/{+parent}/trustConfigs
Create a trust config pinning private CAs
POST
/v1/{+name}:cancel
Cancel a long-running operation
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Google Cloud service account keys with the cloud-platform scope are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped short-lived access tokens — service account JSON never enters the agent context.
Intent-based discovery
Agents search Jentic by intent (e.g. 'provision a TLS certificate for example.com on Google Cloud') and Jentic returns the certificates.create operation with its full input schema.
Time to first call
Direct integration: 2-3 days for service account setup, IAM role configuration, and operation polling. Through Jentic: under 1 hour — search, load, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Certificate Manager API through Jentic.
What authentication does the Certificate Manager API use?
It requires OAuth 2.0 with the cloud-platform scope, typically via a Google Cloud service account key. Through Jentic, that service account credential lives in the Jentic vault and the agent receives only short-lived access tokens scoped to the request.
Can I provision a Google-managed TLS certificate via the API?
Yes. POST a Certificate resource to /v1/{parent}/certificates with managed.domains set to the hostnames to cover. The provisioning is asynchronous; poll the returned operation under /v1/{+name}/operations until done is true and the certificate state is ACTIVE.
What are the rate limits for the Certificate Manager API?
Google Cloud applies per-project per-minute quotas (typically 60 write operations per minute and higher read quotas). Long-running operations such as managed certificate issuance can take several minutes to reach ACTIVE due to domain validation, not API throttling.
How do I create a certificate map entry through Jentic?
Use the Jentic search query "create a certificate map entry" to discover the certificateMaps.certificateMapEntries.create operation, load its schema, then execute it with the parent map, the hostname, and the certificate resource name. Run pip install jentic to get started.
Does the Certificate Manager API support self-managed certificates?
Yes. Provide selfManaged.pemCertificate and selfManaged.pemPrivateKey when creating a Certificate resource. Self-managed certificates do not auto-renew — the caller must rotate them by patching or replacing the resource before expiry.
Is the Certificate Manager API free?
API calls themselves are free. Google Cloud charges for active certificates and trust configs based on the load balancer pricing tier they are attached to. See the Google Cloud Certificate Manager pricing page for current rates.
GET STARTED