GCP Certificate Manager cost: public certs free, private CA priced
Google-managed public TLS certificates are free; the cost is Certificate Authority Service for private CAs, billed per CA per month plus per certificate issued. For public TLS, there is nothing to pay. Here is the model.
Quick answer
Google-managed public TLS certificates (via Certificate Manager) are free, issued and renewed automatically for your load balancers and services. Cost appears only with Certificate Authority Service (CAS) for private, internal certificates, billed per CA per month (by tier) plus per certificate issued. So for standard public HTTPS there is nothing to pay; only internal PKI with a private CA incurs cost.
Google Cloud Certificate Manager handles TLS certificates for your services. The reassuring headline is that public, Google-managed certificates are free, issued and auto-renewed for your load balancers. Cost only appears when you run a private certificate authority for internal PKI, which is a separate service.
Public certificates are free
Google-managed public TLS certificates, the ones securing your public HTTPS endpoints, are provisioned and renewed automatically at no charge. So the common case, securing a public website or API with managed TLS, costs nothing for the certificates. This mirrors free managed public certificates on other clouds.
Private CA is where cost appears
| Component | Cost |
|---|---|
| Google-managed public certificates | Free |
| Certificate Authority Service (CA) | Per CA per month, by tier (DevOps or Enterprise) |
| Certificate issuance | Per certificate issued from a private CA |
Certificate Authority Service (CAS) runs private certificate authorities for internal PKI, issuing certificates for internal services, mTLS, and IoT devices. It bills per CA per month (by tier, with DevOps cheaper than Enterprise) plus a charge per certificate issued. So an internal PKI with high certificate issuance volume accrues cost that public certificates do not.
Controlling certificate cost
Use free Google-managed public certificates for public HTTPS, which covers most needs. Use Certificate Authority Service only where you genuinely need a private CA for internal PKI, choose the appropriate CA tier (DevOps for higher-volume, lower-cost issuance where its terms fit; Enterprise where its features are needed), and manage certificate issuance volume. Because public TLS is free, the only cost decision is the private-CA tier and issuance, which applies to internal PKI, not standard public HTTPS.
FAQ
How is GCP Certificate Manager priced?
Google-managed public TLS certificates are free, issued and auto-renewed for your load balancers and services. Cost appears only with Certificate Authority Service (CAS) for private, internal certificate authorities, billed per CA per month (by tier) plus a charge per certificate issued. Public HTTPS certificates cost nothing.
Are GCP public TLS certificates free?
Yes. Google-managed public TLS certificates, which secure public HTTPS endpoints on your load balancers and services, are provisioned and renewed automatically at no charge. So securing a public website or API with managed TLS costs nothing for the certificates themselves.
What costs money in GCP certificate management?
Certificate Authority Service (CAS), which runs private certificate authorities for internal PKI. It bills per CA per month (by tier, DevOps or Enterprise) plus a charge per certificate issued. Public managed certificates are free; only private CAs for internal certificates, mTLS, or IoT incur cost.
How do I reduce GCP certificate cost?
Use free Google-managed public certificates for public HTTPS, which covers most needs. Use Certificate Authority Service only where you genuinely need a private CA for internal PKI, choose the appropriate CA tier for your issuance volume, and manage certificate issuance volume. Public TLS being free means most workloads pay nothing.
When do I need Certificate Authority Service?
When you need a private certificate authority for internal PKI: issuing certificates for internal services, mutual TLS between services, or IoT device identity. For public-facing HTTPS, free Google-managed public certificates suffice. CAS is for private, internal certificate needs that public certificates cannot serve.
Does C3X estimate certificate cost?
C3X prices Certificate Authority Service resources from your Terraform where you run private CAs, so the per-CA cost appears before deploy. Public managed certificates are free. Certificate issuance volume from a private CA is a usage input you model.
What to do next
Estimate your PKI and the stack around it before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.
Related posts
- GCP Private Service Connect cost: what private access is worth
Private Service Connect gives you a private IP inside your VPC for a Google or third-party service. It charges per endpoint hour and per gigabyte, and it usually beats routing the same traffic through Cloud NAT.
- Private IP vs public IP data transfer cost: the free path you might be missing
Traffic between resources over private IPs in the same AZ is free, but the same traffic over public or Elastic IPs is charged even within a region. Using the wrong address turns free traffic into a per-GB bill. Here is how to keep it free.
- GCP Secret Manager cost: per secret version and per access
Secret Manager bills about $0.06 per active secret version per location per month and about $0.03 per 10,000 access operations. It is cheap unless you store many versions or access secrets on every request. Here is the model and the caching lever.
- GCP Security Command Center cost: tiers from free to enterprise
Security Command Center has a free Standard tier and paid Premium and Enterprise tiers priced by subscription or by resource consumption. Enabling premium across an entire organization drives the bill. Here is how the tiers price.
Share this post
Try C3X on your own Terraform
Free and open source. No API key required. One command to install, one command to estimate.