GCP Certificate Manager cost: public certs free, private CA priced

Quick answer

Google-managed public TLS certificates (via Certificate Manager) are free, issued and renewed automatically for your load balancers and services. Cost appears only with Certificate Authority Service (CAS) for private, internal certificates, billed per CA per month (by tier) plus per certificate issued. So for standard public HTTPS there is nothing to pay; only internal PKI with a private CA incurs cost.

Google Cloud Certificate Manager handles TLS certificates for your services. The reassuring headline is that public, Google-managed certificates are free, issued and auto-renewed for your load balancers. Cost only appears when you run a private certificate authority for internal PKI, which is a separate service.

Public certificates are free

Google-managed public TLS certificates, the ones securing your public HTTPS endpoints, are provisioned and renewed automatically at no charge. So the common case, securing a public website or API with managed TLS, costs nothing for the certificates. This mirrors free managed public certificates on other clouds.

Private CA is where cost appears

Component	Cost
Google-managed public certificates	Free
Certificate Authority Service (CA)	Per CA per month, by tier (DevOps or Enterprise)
Certificate issuance	Per certificate issued from a private CA

Certificate Authority Service (CAS) runs private certificate authorities for internal PKI, issuing certificates for internal services, mTLS, and IoT devices. It bills per CA per month (by tier, with DevOps cheaper than Enterprise) plus a charge per certificate issued. So an internal PKI with high certificate issuance volume accrues cost that public certificates do not.

Controlling certificate cost

Use free Google-managed public certificates for public HTTPS, which covers most needs. Use Certificate Authority Service only where you genuinely need a private CA for internal PKI, choose the appropriate CA tier (DevOps for higher-volume, lower-cost issuance where its terms fit; Enterprise where its features are needed), and manage certificate issuance volume. Because public TLS is free, the only cost decision is the private-CA tier and issuance, which applies to internal PKI, not standard public HTTPS.

FAQ

How is GCP Certificate Manager priced?

Google-managed public TLS certificates are free, issued and auto-renewed for your load balancers and services. Cost appears only with Certificate Authority Service (CAS) for private, internal certificate authorities, billed per CA per month (by tier) plus a charge per certificate issued. Public HTTPS certificates cost nothing.

Are GCP public TLS certificates free?

Yes. Google-managed public TLS certificates, which secure public HTTPS endpoints on your load balancers and services, are provisioned and renewed automatically at no charge. So securing a public website or API with managed TLS costs nothing for the certificates themselves.

What costs money in GCP certificate management?

Certificate Authority Service (CAS), which runs private certificate authorities for internal PKI. It bills per CA per month (by tier, DevOps or Enterprise) plus a charge per certificate issued. Public managed certificates are free; only private CAs for internal certificates, mTLS, or IoT incur cost.

How do I reduce GCP certificate cost?

Use free Google-managed public certificates for public HTTPS, which covers most needs. Use Certificate Authority Service only where you genuinely need a private CA for internal PKI, choose the appropriate CA tier for your issuance volume, and manage certificate issuance volume. Public TLS being free means most workloads pay nothing.

When do I need Certificate Authority Service?

When you need a private certificate authority for internal PKI: issuing certificates for internal services, mutual TLS between services, or IoT device identity. For public-facing HTTPS, free Google-managed public certificates suffice. CAS is for private, internal certificate needs that public certificates cannot serve.

Does C3X estimate certificate cost?

C3X prices Certificate Authority Service resources from your Terraform where you run private CAs, so the per-CA cost appears before deploy. Public managed certificates are free. Certificate issuance volume from a private CA is a usage input you model.

What to do next

Estimate your PKI and the stack around it before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.