Google Trust Services
docs.cloud.google.com/certificate-manager/docs/public-caCertificate authoritydomains-dns/google-trust-servicesJSONcomparereport an errorprovider JSON
- Free allowance
- Certificates from the Public CA ACME endpoint are free; the quota is 100 new orders per hour per Google Cloud project, with wildcard names over the DNS challenge
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- cardcard required, no phone
- Binding limit
- request-rate100 new orders per hour per Google Cloud project, shared by all ACME accounts in that project; 25 new accounts per minute and 100 per hour
- Evidence
- documented15 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-04checked 2026-11-03 (live); stale on 2026-12-04
| Free tier | certificates from the Public CA ACME endpoint are free; the quota is 100 new orders per hour per Google Cloud project, with wildcard names over the DNS challenge unit requests; metered on request-count |
|---|
| Price | none stated |
|---|
| Limits | - request-rate (binding) 100 new orders per hour per Google Cloud project, shared by all ACME accounts in that project source
- request-rate (binding) 25 new accounts per minute and 100 per hour source
- write-gated an EAB secret is valid 7 days and registers one ACME account only source
- retention-clamped certificates are good for up to 90 days source
|
|---|
| Binding | request-rate 100 new orders per hour per project bounds issuance, far above one user's need; the billing link on the project is the gate that decides who can use it |
|---|
| Identity | card a Google Cloud project is required, and the Cloud Billing page says a project not linked to an active Cloud Billing account cannot use Google Cloud services even when they are free; that account is tied to a Google payments profile and a payment method; the Public CA tutorial lists no billing step, so whether the Public CA API can be enabled with no payment method on file is unverified: behind a sign-up (https://docs.cloud.google.com/billing/docs/how-to/create-billing-account, https://docs.cloud.google.com/ruby/docs/reference/google-cloud-security-public_ca/latest) |
|---|
| Egress | no charge |
|---|
| Per-object cap | no certificate size cap stated on the pages read; the quotas are on requests and not on objects |
|---|
| Retention | certificates are good for up to 90 days by default and a client may ask for as little as 1 day; the ACME account has no expiry, and an EAB secret must be used within 7 days (90 days) |
|---|
| Interface | rest, cli ACME v2 at https://dv.acme-v02.api.pki.goog/directory (staging at https://dv.acme-v02.test-api.pki.goog/directory) with external account binding required; the EAB key is made with the Public CA API or gcloud publicca external-account-keys create |
|---|
| Tooling | certbot, acme.sh, any ACME client that supports EAB, the gcloud CLI for the EAB key |
|---|
| Composes with | a free ACME CA run by a different operator than Let's Encrypt and ZeroSSL, with wildcard names over DNS-01 and certificates down to 1 day; the cost is a Google Cloud project that must be linked to a Cloud Billing account |
|---|
| Reliability | the ACME service does not support retrying a challenge, so a client requests a new authorization after a failed validation; no outage history was read |
|---|
| Notes | The 90-day figure is the default for the ACME endpoint. Certificate Manager's own Google-managed certificates are moving to 45 days, which is a different path from a client using ACME directly. |
|---|
| Evidence note | documented the Public CA tutorial, concepts page, quota page, Google blog and ACME divergence page were captured and quoted; the production directory answered 200 with externalAccountRequired true. The card requirement is read from the billing page and a client-library quick start and was not seen at a sign-up. |
|---|
| Parsed numbers | |
|---|
Evidence 15