IssueTracker

I would like to offload the TLS from the load balancer to something that can talk to cloud hsm, and perform the TLS termination

The hard requirements I have are:

• All API interactions must happen over TLS 1.2
• An EV certificate is required for TLS communication with 3rd party
• HSM operating at FIPS 140-2 Level 3 is hard requirement for key storage of the private key used to generate the certificate BAC will trust with 3rd Party
• Key Length - 2048 bit is minimum can go up to 4096 bit
• Be eligible for again of 2-yr validity cert
• The certificate Common Name or Subject name must contain a Fully Qualified Domain Name (FQDN) and can contain the vendor name if required.

Basically, I need to provide a certificate that my network is FIPS Level 3 validated, but think it is not possible on GCP right now, I would like to share an example which is from a competitor but it is what I would like to have. Would it be possible to run this scenario by the team responsible for KMS?

https://docs.aws.amazon.com/cloudhsm/latest/userguide/ssl-offload-overview.html

Do you know of any workaround that can do the TLS termination by checking a Private Key that is stored inside the Google HSM? Be it an nginx/ gce ingress / neg or otherwise?

Alternatively, would it be possible to use CMEK with the uploaded private certificate in google cert manager?

Kind Regards,