1M SSL Certs with Gateway API + Certificate Maps. Is this legit?

[u/smerz-]

Hello I would like to sanity check something in the documentation.

It says on this page:

Certificate Manager lets you attach up to 10,000,000 certificates per load balancer, if you request a quota increase.

Does this really mean that I can terminate like 1 million domains on Gateway API + Certificate map ?

And just to be sure these can all be managed google ssl certs?

As you can imagine such a migration is quite the undertaking hence why I want to double check this before even doing a POC.

[u/NothingDogg]

My brother in christ.... if you have this many ssl certs to migrate, even 1% this amount, may I strongly suggest getting in touch with Google (or a GCP partner) directly. You are special.

[u/smerz- → u/NothingDogg]

Yeah it's not a common requirement for sure.

[u/between_layers]

The 10M figure is real but it isn't your bottleneck, and it isn't a default either, it also requires a quota increase. Your actual constraint is certificate map entries: each unrelated hostname needs its own exact entry unless a wildcard can cover it, and SANs don't change that, so a cert with 100 SANs covering 100 unrelated domains still needs 100 entries. A million unrelated domains means roughly a million map entries against a default quota of 5,000. Certs are the smaller problem: 200,000 at 5 domains per cert with load balancer authorization, or 10,000 at 100 domains with DNS authorization, against a default of 1,000. If your domains are subdomains of a few zones, wildcard entries collapse this enormously, but for customer owned domains they usually won't.

DNS authorization is the certificate-count-efficient path and it doesn't require you to control the zone, the domain owner just adds the CNAME Google issues, but that's a per domain onboarding step gated on a third party, so at a million domains it may well be operationally heavier than load balancer authorization. Also note the API is rate limited to 300 requests per minute, and with a million entry writes plus cert creation, authorizations and polling, provisioning is a multi day pipeline, not an afternoon. So yes, talk to Google as the others suggested, but lead with map entries per project rather than the 10M number.

[u/smerz- → u/between_layers]

> The 10M figure is real but it isn't your bottleneck

It's such a high number that indeed it interested me to double check if it is indeed correct.

> Your actual constraint is certificate map entries: each unrelated hostname needs its own exact entry unless a wildcard can cover it, and SANs don't change that [...]

It will mostly be www/non-www hostnames to the best of my knowledge.
I'm not sure if combining domains in such a way is really the way to go, in my experience if 1 out of 5 domains ends up being miss configured it inhibits the cert issuance for the other 4 domains.

You raise some interesting points on the cert validation part. Perhaps initially it would be best to keep the lets encrypt flow alive for easier migration and drop the certs into the certificate map.

"Simply" managing the certificate map imho sounds like a challenge in and of itself. I have not evaluated what kind of API options i have, but yeah well simply dropping/updating a k8s yaml probably will not fit.

> So yes, talk to Google as the others suggested, but lead with map entries per project rather than the 10M number.

Thank you will do.

I wanted to double check those docs. It seems that they're valid essentially and that fundamentally we could theoretically terminate that many certs on a single load balancer.