google_certificate_manager_certificate cost estimation
TLS certificates for Google Cloud load balancers. Google-managed and self-managed certificates are free. Cost lives in the load balancer that serves them and, for private PKI, in Certificate Authority Service.
The google_certificate_manager_certificate resource provisions TLS certificates for use with Google Cloud load balancers and other integrated services. Both Google-managed certificates (where Google handles issuance and renewal through Let's Encrypt or Google Trust Services) and self-managed certificates (where you upload your own key and chain) are free. There is no per-certificate fee, no renewal fee, and no charge for the certificate at rest. Certificate Manager also supports many certificates per map and wildcard and SAN entries at no extra cost.
Because the certificate is free, the cost sits in what actually terminates and serves TLS: the load balancer. A Google Cloud external Application Load Balancer bills a forwarding rule at about $0.025/hour (roughly $18/month) plus data processing at about $0.008 to $0.012/GB depending on tier. That forwarding-rule and data-processing cost is present whether you use one certificate or fifty, so certificates never move that number. The certificate is simply the free credential the paid load balancer presents.
Private PKI is the exception where cost appears near this resource. If you need internally trusted certificates rather than publicly trusted ones, you use Certificate Authority Service (CAS), which is billed separately from Certificate Manager. The CAS Enterprise tier is about $200/month per certificate authority plus a per-certificate fee, while the DevOps tier is about $20/month per CA with a lower per-certificate rate. So a public cert through Certificate Manager is free, but standing up your own CA to issue private certs is a real monthly commitment.
The cost-adjacent gotcha is confusing free certificates with a free HTTPS endpoint. Teams sometimes assume enabling managed TLS is the whole cost, then are surprised by the load balancer's forwarding-rule and egress charges. The certificate is free; serving traffic over it is not. Also note that Certificate Manager API operations have a free quota, and only unusually high automation volume would push past it.
c3x flags google_certificate_manager_certificate as free and attributes serving cost to the load balancer and any private-PKI cost to Certificate Authority Service.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "google_certificate_manager_certificate" "default" {
name = "app-cert"
description = "Managed cert for app.example.com"
managed {
domains = [
"app.example.com",
"www.example.com",
]
}
}
resource "google_certificate_manager_certificate_map" "default" {
name = "app-cert-map"
}
resource "google_certificate_manager_certificate_map_entry" "default" {
name = "app-entry"
map = google_certificate_manager_certificate_map.default.name
certificates = [google_certificate_manager_certificate.default.id]
hostname = "app.example.com"
}Pricing dimensions
What you actually pay for when you provision google_certificate_manager_certificate.
| Dimension | Unit | What's being charged |
|---|---|---|
| Managed or self-managed certificate | free | Google-managed and uploaded certificates are free to issue, renew, and store, including wildcards and SANs. $0 (free) |
| Load balancer forwarding rule | per hour | The external Application Load Balancer that terminates TLS and serves the certificate. about $0.025/hour (about $18/month) |
| Load balancer data processing | per GB | Traffic processed by the load balancer serving the certificate, tier dependent. about $0.008 to $0.012/GB |
| CA Service (Enterprise tier) | per month per CA | Only for private PKI. Each certificate authority in the Enterprise tier plus a per-certificate fee. about $200/month per CA |
| CA Service (DevOps tier) | per month per CA | Lower-cost private CA tier for high-volume, short-lived certificate issuance. about $20/month per CA |
Optimization tips
Common ways to reduce google_certificate_manager_certificate cost without changing the workload.
Use free managed certificates for public endpoints
$20 to $200/month per avoided CAGoogle-managed certificates are free and auto-renew. Reserve Certificate Authority Service, which carries a real monthly CA fee, for internally trusted private certificates only.
Consolidate certificates behind one load balancer
$18/month per avoided forwarding ruleThe forwarding rule and data-processing cost is per load balancer, not per certificate. Serve many domains through one load balancer with a certificate map rather than standing up a load balancer per domain.
Use wildcard and SAN certificates
A single managed certificate can cover multiple domains and a wildcard at no extra cost, cutting the number of certificates you manage without affecting the bill.
Share one private CA across services
$200/month per avoided Enterprise CACA Service bills per certificate authority. If you need private PKI, issue all internal certificates from one shared CA per environment rather than one CA per service.
FAQ
Are Certificate Manager certificates free?
Yes. Google-managed certificates (issued and auto-renewed for you) and self-managed certificates (uploaded by you) are both free, including wildcards and SANs. There is no per-certificate or renewal fee.
If the certificate is free, what am I paying for?
The load balancer that terminates TLS and serves the certificate. An external Application Load Balancer bills a forwarding rule at about $18/month plus data processing per GB, regardless of how many certificates it serves.
When does TLS on Google Cloud actually cost money?
When you need private, internally trusted certificates. Certificate Authority Service is billed separately: about $200/month per CA on the Enterprise tier or about $20/month per CA on the DevOps tier, plus a per-certificate fee. Public certificates through Certificate Manager stay free.
Do Certificate Manager API calls cost anything?
There is a free quota for Certificate Manager operations. Normal provisioning and renewal stay within it. Only unusually high automation volume would push past the free tier into billed operations.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including google_certificate_manager_certificate.