How to upgrade TLS version for serverless service on GCP (Google Cloud Platform)
Tags: tls, gcp, https, serverless
Published: 2022-09-29 22:44:12

---
title: How to upgrade TLS version for serverless service on  GCP (Google Cloud Platform)
published: true
description: Upgrading a TLS version for serverless service on Google cloud platform
tags: TLS, GCP, HTTPS, Serverless
cover_image: https://res.cloudinary.com/denj7z5ec/image/upload/v1664317156/SSL_certificate_and_how_does_it_work__2_j3az12.png
# Use a ratio of 100:42 for best results.
---

For the past few days, I've been battling with the issue of upgrading the TLS version for a few cloud-run apps, the plan is to set the minimum version to v1.2 as required by slack, After a lot of trial and error, I got it fixed and I will be discussing the procedures in this blog post.

### What is TLS?
TLS (Transport Layer Security) is a cryptographic protocol developed to provide communication security over a network, it is widely adopted to facilitate privacy and data over the internet network. TLS is used in securing HTTPS, which means that HTTPS(Hypertext Transfer Protocol Secure) uses TLS to ensure data integrity over the internet.
It was earlier called SSL, which was later changed to TLS in 1999.

### Our current setup
We have three(3) cloud run services;
* A website
* A REST API endpoints
* Slack bot

This procedures requires that we:
* Reserve an external static IP Address
* Setup Load balancer
* Create certificate 
* Create an SSL Policy
* Setup Network endpoint group
* Create an A record to map the cloud run app(in our case, yours could be cloud functions, app engine, etc) domain with the IP Address reserved in step 1

### Reserve an external static IP Address 
An idea approach will be to reserve external static IP Addresses for each of the services, alongside with load balancer which tends to cost us more, so instead we reserve an IP address to be used for all.

![Reserve an ip address](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4k2131e1bz8s4mtgezap.png)


### Create a load balancer
Load balancing refers to an efficient approach to distributing incoming network traffic across a group of backend servers,server farm or server pool.

Setting up a load balancer allows us to configure other steps listed above.

![Setup a load balancer](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/31urvx92virkpgsbj57x.png)

Click on HTTPS
![Select https](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/glqqnbr2vdh2tji5l6yi.png)
Make sure global load balancing (classic) is selected
![Selecting global load balancing option](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/534nqy4sfcin47amv20n.png)

**Setup frontend that distribute traffic**
The frontend configuration of the load balancer requires that you specified a reserved IP address, protocol type, certificate and SSL policy.This is the most important part of the load balancing as you need to carefully provides the appropriate information for all the required fields as seen in the screenshots below.

![Setup frontend for load balancer](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mhl58nc8q2fffrv1r585.png)


![Select HTTPS](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yxmw2a3t1wrc9b2btd6o.png)


Select the IP Address you reserved earlier

![Select IP Address reserved earlier](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zqdtcasu6v0zcl82m04j.png)


Click on create policy to create if you haven’t done that before

![List SSL policy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wfn681sovcvi4vj9qpa2.png)


 You need to specify your TLS minimum version for the new SSL policy.

![Select TLS version](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y417iqlet7pqs8sbcey4.png)


Click on backend configuration, when you're done with the frontend.
![Create backend configuration](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yxk6n8y8n6azgrykrl8h.png)


Click on create backend configuration and create new backend service or select if you already have one.

![Create a backend service](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7u7q8m06655jtcmuw8nd.png)

**Create network endpoint group**
A network endpoint group (NEG) is a configuration that specifies group of backend services, it is common used for deploying service in container.

![Create a network endpoint group](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m0lv3i5odgbd78mumo4q.png)

At this point, you need to select your serverless network type, in my own case, its cloud run.

![Create a backend](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dpf1j7zlb65dkwvc0p95.png)
By selecting the serverless NEG type, it should list out your current app running.
![Select serverless app](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/skot5kddfhxj8avhdbyp.png)



Finally 🎉, You can decide to create multiple backend for multiple services depending on your setup, which should give you something related to this or just have a single backend service.
![Final step](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g2vlh7h9actti5oldeob.png)


Setup A record for DNS mapping
![Setup A record for DNS mapping](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d9vlx2fp4zhceu4ulnxh.png)

### How to check the TLS version
Install a cli tool called nmap, and run  
```
nmap --script ssl-enum-ciphers -p 443 domainname.com

```
Your output should be... viola 🎉
```
PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|     compressors: 
|       NULL
|     cipher preference: client
|   TLSv1.3: 
|     ciphers: 
|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|     cipher preference: client
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 2.83 seconds

```
I'm sure you might be surprised to see TLSv1.3 by default,😉 Yes!, that's because google adds it for every certificate at the time of writing this post.

Thanks for reading ✌️