# Cis Gke Autopilot V100 5.4.5

> Ensure use of Google-managed SSL Certificates (Automated)

- Skill: `cyberstrikeus/cis-gke-autopilot-v100-5-4-5` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-gke-autopilot-v100-5-4-5`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-gke-autopilot-v100-5-4-5/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-gke-autopilot-v100-5-4-5

---


# 5.4.5 Ensure use of Google-managed SSL Certificates (Automated)

## Profile Applicability

- Level 2

## Description

Encrypt traffic to HTTPS load balancers using Google-managed SSL certificates.

## Rationale

Encrypting traffic between users and the Kubernetes workload is fundamental to protecting data sent over the web.

Google-managed SSL Certificates are provisioned, renewed, and managed for domain names. This is only available for HTTPS load balancers created using Ingress Resources, and not TCP/UDP load balancers created using Service of `type:LoadBalancer`.

## Impact

Google-managed SSL Certificates are less flexible than certificates that are self obtained and managed. Managed certificates support a single, non-wildcard domain. Self-managed certificates can support wildcards and multiple subject alternative names (SANs).

## Audit

**Using Command Line:**
Identify if there are any workloads exposed publicly using Services of `type:LoadBalancer`:

```bash
kubectl get svc -A -o json | jq '.items[] | select(.spec.type=="LoadBalancer")'
```

Consider using ingresses instead of these services in order to use Google managed SSL certificates.

For the ingresses within the cluster, run the following command:

```bash
kubectl get ingress -A -o json | jq .items[] | jq '{name: .metadata.name, annotations: .metadata.annotations, namespace: .metadata.namespace, status: .status}'
```

The above command should return the name of the ingress, namespace, annotations and status. Check that the following annotation is present to ensure managed certificates are referenced.

```json
"annotations": {
    ...
    "networking.gke.io/managed-certificates": "<example_certificate>"
},
```

For completeness, run the following command to ensure that the managed certificate resource exists:

```bash
kubectl get managedcertificates -A
```

The above command returns a list of managed certificates for which `<example_certificate>` should exist within the same namespace as the ingress.

## Remediation

If services of `type:LoadBalancer` are discovered, consider replacing the Service with an Ingress.

To configure the Ingress and use Google-managed SSL certificates, follow the instructions as listed at: https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs.

## Default Value

By default, Google-managed SSL Certificates are not created when an Ingress resource is defined.

## References

1. https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs
2. https://cloud.google.com/kubernetes-engine/docs/concepts/ingress

## CIS Controls

| Controls Version | Control                                           | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.10 Encrypt Sensitive Data in Transit            |      | x    | x    |
| v7               | 14.4 Encrypt All Sensitive Information in Transit |      | x    | x    |