如果您使用的是 GKE，請按照「
保留靜態外部 IP 位址」一文中的操作說明，建立兩個靜態 IP 位址。您可以為地址命名，例如 apigee-hybrid-mart 和 apigee-hybrid-runtime。完成後，您將有兩個 IP 號碼，可在下一個步驟的叢集設定中使用。例如：35.225.131.189 和 34.66.75.196
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-21 (世界標準時間)。"],[[["\u003cp\u003eThis document provides an example of how to obtain a TLS certificate from Let's Encrypt using Certbot and Google Cloud DNS, mainly intended for users who lack an alternative method for acquiring authorized certificate/key pairs.\u003c/p\u003e\n"],["\u003cp\u003eTLS credentials are required for the MART ingress gateway, and are either necessary or optional for the runtime ingress gateway.\u003c/p\u003e\n"],["\u003cp\u003eSetting up Cloud DNS involves obtaining a qualified domain name, creating static IP addresses, and configuring DNS records for both MART and runtime ingress endpoints.\u003c/p\u003e\n"],["\u003cp\u003eTo get authorized certificates from Let's Encrypt, you will install the Certbot client with the dns_google plugin on a Google Cloud VM, and update your overrides file with the paths to the obtained certificate and key.\u003c/p\u003e\n"],["\u003cp\u003eYou will be required to apply changes to either the 'mart' or the 'envs' configuration depending on what was modified, and then deploy and test a proxy.\u003c/p\u003e\n"]]],[],null,["# Obtain TLS credentials: An example\n\n| You are currently viewing version 1.2 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic is intended as an example only. It explains how to obtain a TLS certificate from\nthe certificate authority (CA) [Let's Encrypt](https://letsencrypt.org).\nThese steps are provided primarily as an example to follow if you do not have\nanother ready way to obtain a certificate/key\npair that is authorized by a CA. The example shows how to generate certificates\nusing the [Let's Encrypt](https://letsencrypt.org) CA, the\n[Certbot client](https://certbot.eff.org/about/), and Google Cloud Platform [Cloud DNS](https://cloud.google.com/dns/docs/).\n\nWhere you can use these credentials\n-----------------------------------\n\n\nYou must provide TLS credentials for two Istio ingress gateways that are exposed\noutside the cluster:\n\nSee also [External connections](/apigee/docs/hybrid/v1.2/ports#external).\n\nRequirements\n------------\n\nYou will need a domain name obtained through a domain name registrar. You can register a domain name through\nGoogle Domains or another domain registrar of your choice.\n\nConfigure Cloud DNS\n-------------------\n\nTo obtain authorized TLS credentials, you must have a qualified domain name. The following steps explain how to use [Google Cloud DNS](https://cloud.google.com/dns/) to obtain a domain name and manage your domain servers.\n\n1. Open the [Google Cloud console](https://console.cloud.google.com) and log in with the account you created in [Step 1: Create a Google Cloud account](/apigee/docs/hybrid/v1.2/precog-gcpaccount).\n2. Select the project that you created in [Step 2: Create a GCP project](/apigee/docs/hybrid/v1.2/precog-gcpproject).\n3. Enable the **Cloud DNS API** . See [Enabling APIs](https://cloud.google.com/apis/docs/getting-started#enabling_apis).\n4. Create two static IP addresses:\n - If you are on GKE, follow the instructions in [Reserving a static external IP address](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address) to create two static IP addresses. You can give the addresses any name you wish, for example: `apigee-hybrid-mart` and `apigee-hybrid-runtime`. When you finish, you will have two IP numbers to use in the cluster configuration in the next step. For example: `35.225.131.189` and `34.66.75.196`\n - If you are on Anthos GKE, follow instructions in the [Anthos GKE documentation](/anthos/clusters/docs/on-prem/1.5/how-to/install-static-ips#configuring_static_ips) to create two static IP addresses.\n5. Create a managed public zone. For instructions, see [Create a managed public zone](https://cloud.google.com/dns/docs/set-up-dns-records-domain-name#create_a_managed_public_zone).\n6. Get the External IP you reserved for the `apigee-hybrid-mart`.\n7. Create record set for the MART endpoint. Enter the External IP you obtained in the previous step and add a prefix to the domain name, such as `mart`. For instructions, see [Create a new record](https://cloud.google.com/dns/docs/set-up-dns-records-domain-name#create_a_new_record).\n\n8. Get the External IP that you reserved for `apigee-hybrid-runtime`.\n9. Create record set for the Istio ingress endpoint. This is the address for making API calls to the hybrid gateway. Enter the External IP you obtained in the previous step and add a prefix to the domain name, such as `apitest`. For instructions, see [Create a new record](https://cloud.google.com/dns/docs/set-up-dns-records-domain-name#create_a_new_record).\n\n10. Copy the DNS record data, as shown in the following example:\n\n11. Return to your domain page at [Google Domains](https://domains.google.com).\n12. Select your domain.\n13. Select **DNS**.\n14. In the Name Servers section, click **Edit**.\n15. Enter the domain name servers that you copied from the Network Services Cloud DNS\n page:\n\n\nNow, your Google Cloud DNS will manage the DNS records for your domain.\n\nInstall Certbot on a VM\n-----------------------\n\n\nNow that you have Cloud DNS set up to manage your domain servers, you will install the\nCertbot client with the\n[dns_google](https://certbot-dns-google.readthedocs.io/en/stable/) plugin on a Cloud VM. The client enables\nyou to get authorized certificates for your domain from a Let's Encrypt endpoint.\n\n1. Open the [Google Cloud console](https://console.cloud.google.com) and log in with the account you created in [Step 1: Create a Google Cloud account](/apigee/docs/hybrid/v1.2/precog-gcpaccount).\n2. Select the project that you created in [Step 2: Create a GCP project](/apigee/docs/hybrid/v1.2/precog-gcpproject).\n3. Select **IAM \\& admin \\\u003e Service accounts** .\n\n The **Service accounts view** displays a list of the project's service accounts.\n4. To create a new service account, click **+Create Service Account** at the top of the view.\n\n The **Service account details** view displays.\n5. In the **Service account name** field, enter the name of the service account.\n\n You can optionally add a description in the **Service account description**\n field. Descriptions are helpful at reminding you what a particular service account is used\n for.\n6. Click **Create** .\n\n GCP creates a new service account and displays the **Service account\n permissions** view. Use this view to assign a role to your new service account.\n7. Click the **Select a role** drop-down list.\n8. Select the **Project Owner** role.\n9. Click **Continue**.\n10. Click **Done**.\n11. In the GCP console, select **Compute Engine \\\u003e VM Instances**.\n12. Create a VM instance named **certmanager**.\n13. Under the Boot Disk section, choose CentOS7 and 20 GB for the SSD persistent drive.\n14. Set the Service Account to the one you created above.\n15. Install Certbot and the [dns_google](https://certbot-dns-google.readthedocs.io/en/stable/) plugin on the machine and run the Certbot client: \n\n sudo su -\n yum -y install yum-utils\n yum install certbot -y\n yum install certbot-dns-google -y\n certbot certonly --dns-google -d *.\u003cvar translate=\"no\"\u003eyour_domain_name\u003c/var\u003e,*.\u003cvar translate=\"no\"\u003eyour_domain_name\u003c/var\u003e --server https://acme-v02.api.letsencrypt.org/directory\n \n\n For example: \n\n sudo su -\n yum -y install yum-utils\n yum install certbot -y\n yum install certbot-dns-google -y\n certbot certonly --dns-google -d *.apigee-hybrid-docs.net,*.apigee-hybrid-docs.net --server https://acme-v02.api.letsencrypt.org/directory\n\n16. You can now find your authorized certificate and private key files in this directory: `cd /etc/letsencrypt/live/`\u003cvar translate=\"no\"\u003eyour_domain_name\u003c/var\u003e`/`\n\n\n For example:\n\n\n cd /etc/letsencrypt/live/apigee-hybrid-docs.net\n ls\n cert.pem chain.pem fullchain.pem privkey.pem README\n\n \u003cbr /\u003e\n\n17. Copy the files `fullchain.pem` and `privkey.pem` to your local machine.\n18. Update your overrides file to point to the certificate and private key. For the `hostAliases`, use the DNS name that you created previously.\n\n\n For example: \n\n ```\n ...\n envs:\n - name: test\n serviceAccountPaths:\n synchronizer: \"your_keypath/synchronizer-manager-service-account.json\n udca: \"your_keypath/analytic-agent-service-account.json\n\n virtualhosts:\n - name: default\n hostAliases: [\"apitest.apigee-hybrid-docs.net\"]\n sslCertPath: \"$HOME/hybrid/apigee-hybrid-setup/tls/fullchain.pem\"\n sslKeyPath: \"$HOME/hybrid/apigee-hybrid-setup/tls/privkey.pem\"\n routingRules:\n - env: test\n\n mart:\n nodeSelector:\n key: cloud.google.com/gke-nodepool\n value: apigee-runtime\n sslCertPath: \"$HOME/hybrid/apigee-hybrid-setup/tls/fullchain.pem\"\n sslKeyPath: \"$HOME/hybrid/apigee-hybrid-setup/tls/privkey.pem\"\n replicaCountMin: 1\n replicaCountMax: 1\n hostAlias: \"mart.apigee-hybrid-docs.net\"\n ```\n19. Apply the changes:\n If you changed the `mart` configuration, apply the changes:\n\n ```\n apigeectl apply -f your_overrides_file -c mart\n ```\n\n\n If you changed the `envs` configuration, apply the changes: \n\n ```\n apigeectl apply -f your_overrides_file -c runtime\n ```\n\nTest the configuration\n----------------------\n\n20. Deploy and test a proxy, as explained in [Create and deploy a new API proxy](/apigee/docs/hybrid/v1.2/test-new-proxy)."]]
