Overview
Use F5 Application Delivery Service for Google Cloud to secure traffic by adding SSL/TLS certificates to a deployment.
NGINX supports the following certificate formats:
- PEM format certificates.
You can upload these certificates as text, as files, or as secrets from Secret Manager.
Encrypt your certificates, keys, and PEM files using one of these standards:
- RSA
- ECC/ECDSA
- ML-DSA (post-quantum)
When you upload an ML-DSA private key using the F5 ADS Console, use the seed-only key format. If you store your ML-DSA key in Google Secret Manager, you can use either the seed-only or seed-priv format. See Enable post-quantum cryptography for configuration guidance.
F5 ADS for Google Cloud supports two ways to manage your certificates and keys securely:
F5 ADS Console: Manage certificates alongside the NGINX configurations that reference them. See Add certificates using the F5 ADS Console.
Google Secret Manager: Fetch secrets directly from Secret Manager, keeping credentials within Google Cloud. See Add certificates from Secret Manager.
F5 ADS for Google Cloud supports automatic and manual rotation for Secret Manager certificates:
Automatic rotation: Let F5 ADS for Google Cloud pick up new certificate versions automatically with no configuration changes needed. See Rotate a Secret Manager certificate (automatic).
Manual rotation: When you need to update certificates immediately, use Reapply Configuration in the console to refetch secrets right away. See Rotate a Secret Manager certificate (manual).