From 46d5503799479519ac06d1cc0ca8b3bc87f7d4bc Mon Sep 17 00:00:00 2001
From: Imran Nayer <imrannayer@google.com>
Date: Mon, 6 Nov 2023 18:38:26 +0000
Subject: [PATCH 1/7] fix cert map

---
 README.md                                     |  16 +-
 autogen/main.tf.tmpl                          |  10 +-
 autogen/outputs.tf.tmpl                       |   5 +
 autogen/variables.tf.tmpl                     |  52 ++---
 examples/certificate-map/README.md            |  30 +++
 examples/certificate-map/certificate-map.tf   |  45 ++++
 examples/certificate-map/gceme.sh.tpl         | 127 ++++++++++++
 examples/certificate-map/gcp-logo.svg         | 142 +++++++++++++
 examples/certificate-map/main.tf              | 188 +++++++++++++++++
 examples/certificate-map/mig.tf               |  57 ++++++
 examples/certificate-map/outputs.tf           |  31 +++
 examples/certificate-map/variables.tf         |  27 +++
 examples/certificate-map/versions.tf          |  36 ++++
 .../user-managed-google-managed-ssl/README.md | 113 +++++++++++
 .../gceme.sh.tpl                              |   1 +
 .../gcp-logo.svg                              | 142 +++++++++++++
 .../user-managed-google-managed-ssl/main.tf   | 192 ++++++++++++++++++
 .../user-managed-google-managed-ssl/mig.tf    |  57 ++++++
 .../outputs.tf                                |  31 +++
 .../user-managed-google-managed-ssl/tls.tf    |  84 ++++++++
 .../variables.tf                              |  27 +++
 .../versions.tf                               |  36 ++++
 main.tf                                       |  10 +-
 modules/dynamic_backends/README.md            |  16 +-
 modules/dynamic_backends/main.tf              |  10 +-
 modules/dynamic_backends/variables.tf         |  52 ++---
 modules/serverless_negs/README.md             |  16 +-
 modules/serverless_negs/main.tf               |  10 +-
 modules/serverless_negs/variables.tf          |  52 ++---
 test/setup/main.tf                            |   2 +
 variables.tf                                  |  52 ++---
 31 files changed, 1521 insertions(+), 148 deletions(-)
 create mode 100644 examples/certificate-map/README.md
 create mode 100644 examples/certificate-map/certificate-map.tf
 create mode 100644 examples/certificate-map/gceme.sh.tpl
 create mode 100644 examples/certificate-map/gcp-logo.svg
 create mode 100644 examples/certificate-map/main.tf
 create mode 100644 examples/certificate-map/mig.tf
 create mode 100644 examples/certificate-map/outputs.tf
 create mode 100644 examples/certificate-map/variables.tf
 create mode 100644 examples/certificate-map/versions.tf
 create mode 100644 examples/user-managed-google-managed-ssl/README.md
 create mode 120000 examples/user-managed-google-managed-ssl/gceme.sh.tpl
 create mode 100644 examples/user-managed-google-managed-ssl/gcp-logo.svg
 create mode 100644 examples/user-managed-google-managed-ssl/main.tf
 create mode 100644 examples/user-managed-google-managed-ssl/mig.tf
 create mode 100644 examples/user-managed-google-managed-ssl/outputs.tf
 create mode 100644 examples/user-managed-google-managed-ssl/tls.tf
 create mode 100644 examples/user-managed-google-managed-ssl/variables.tf
 create mode 100644 examples/user-managed-google-managed-ssl/versions.tf

diff --git a/README.md b/README.md
index 677bc296..90df9227 100644
--- a/README.md
+++ b/README.md
@@ -120,11 +120,12 @@ module "gce-lb-http" {
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | address | Existing IPv4 address to use (the actual IP address value) | `string` | `null` | no |
-| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    port                    = optional(number)<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    timeout_sec                     = optional(number)<br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br>    health_check = object({<br>      host                = optional(string)<br>      request_path        = optional(string)<br>      request             = optional(string)<br>      response            = optional(string)<br>      port                = optional(number)<br>      port_name           = optional(string)<br>      proxy_header        = optional(string)<br>      port_specification  = optional(string)<br>      protocol            = optional(string)<br>      check_interval_sec  = optional(number)<br>      timeout_sec         = optional(number)<br>      healthy_threshold   = optional(number)<br>      unhealthy_threshold = optional(number)<br>      logging             = optional(bool)<br>    })<br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>      balancing_mode               = optional(string)<br>      capacity_scaler              = optional(number)<br>      description                  = optional(string)<br>      max_connections              = optional(number)<br>      max_connections_per_instance = optional(number)<br>      max_connections_per_endpoint = optional(number)<br>      max_rate                     = optional(number)<br>      max_rate_per_instance        = optional(number)<br>      max_rate_per_endpoint        = optional(number)<br>      max_utilization              = optional(number)<br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>    outlier_detection = optional(object({<br>      base_ejection_time = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      consecutive_errors                    = optional(number)<br>      consecutive_gateway_failure           = optional(number)<br>      enforcing_consecutive_errors          = optional(number)<br>      enforcing_consecutive_gateway_failure = optional(number)<br>      enforcing_success_rate                = optional(number)<br>      interval = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      max_ejection_percent        = optional(number)<br>      success_rate_minimum_hosts  = optional(number)<br>      success_rate_request_volume = optional(number)<br>      success_rate_stdev_factor   = optional(number)<br>    }))<br>  }))</pre> | n/a | yes |
-| certificate | Content of the SSL certificate. Required if `ssl` is `true` and `ssl_certificates` is empty. | `string` | `null` | no |
-| certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy | `string` | `null` | no |
+| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    port                    = optional(number)<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    timeout_sec                     = optional(number)<br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br>    health_check = object({<br>      host                = optional(string)<br>      request_path        = optional(string)<br>      request             = optional(string)<br>      response            = optional(string)<br>      port                = optional(number)<br>      port_name           = optional(string)<br>      proxy_header        = optional(string)<br>      port_specification  = optional(string)<br>      protocol            = optional(string)<br>      check_interval_sec  = optional(number)<br>      timeout_sec         = optional(number)<br>      healthy_threshold   = optional(number)<br>      unhealthy_threshold = optional(number)<br>      logging             = optional(bool)<br>    })<br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>      balancing_mode               = optional(string)<br>      capacity_scaler              = optional(number)<br>      description                  = optional(string)<br>      max_connections              = optional(number)<br>      max_connections_per_instance = optional(number)<br>      max_connections_per_endpoint = optional(number)<br>      max_rate                     = optional(number)<br>      max_rate_per_instance        = optional(number)<br>      max_rate_per_endpoint        = optional(number)<br>      max_utilization              = optional(number)<br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>  }))</pre> | n/a | yes |
+| certificate | Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
+| certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true` | `string` | `null` | no |
 | create\_address | Create a new global IPv4 address | `bool` | `true` | no |
 | create\_ipv6\_address | Allocate a new IPv6 address. Conflicts with "ipv6\_address" - if both specified, "create\_ipv6\_address" takes precedence. | `bool` | `false` | no |
+| create\_ssl\_certificate | If `true`, Create certificate using `private_key/certificate` | `bool` | `false` | no |
 | create\_url\_map | Set to `false` if url\_map variable is provided. | `bool` | `true` | no |
 | edge\_security\_policy | The resource URL for the edge security policy to associate with the backend service | `string` | `null` | no |
 | enable\_ipv6 | Enable IPv6 address on the CDN load-balancer | `bool` | `false` | no |
@@ -135,21 +136,20 @@ module "gce-lb-http" {
 | ipv6\_address | An existing IPv6 address to use (the actual IP address value) | `string` | `null` | no |
 | labels | The labels to attach to resources created by this module | `map(string)` | `{}` | no |
 | load\_balancing\_scheme | Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL\_MANAGED for Envoy-based load balancer, and INTERNAL\_SELF\_MANAGED for traffic director) | `string` | `"EXTERNAL"` | no |
-| managed\_ssl\_certificate\_domains | Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` and `use_ssl_certificates` set to `false`. | `list(string)` | `[]` | no |
+| managed\_ssl\_certificate\_domains | Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` | `list(string)` | `[]` | no |
 | name | Name for the forwarding rule and prefix for supporting resources | `string` | n/a | yes |
 | network | Network for INTERNAL\_SELF\_MANAGED load balancing scheme | `string` | `"default"` | no |
-| private\_key | Content of the private SSL key. Required if `ssl` is `true` and `ssl_certificates` is empty. | `string` | `null` | no |
+| private\_key | Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
 | project | The project to deploy to, if not set the default provider project is used. | `string` | n/a | yes |
 | quic | Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only. | `bool` | `null` | no |
 | random\_certificate\_suffix | Bool to enable/disable random certificate name generation. Set and keep this to true if you need to change the SSL cert. | `bool` | `false` | no |
 | security\_policy | The resource URL for the security policy to associate with the backend service | `string` | `null` | no |
-| ssl | Set to `true` to enable SSL support, requires variable `ssl_certificates` - a list of self\_link certs | `bool` | `false` | no |
-| ssl\_certificates | SSL cert self\_link list. Required if `ssl` is `true` and no `private_key` and `certificate` is provided. | `list(string)` | `[]` | no |
+| ssl | Set to `true` to enable SSL support. If `true` then at least one of these are required: 1) `ssl_certificates` OR 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  3) `managed_ssl_certificate_domains`, OR 4) `certificate_map` | `bool` | `false` | no |
+| ssl\_certificates | SSL cert self\_link list. Requires `ssl` to be set to `true` | `list(string)` | `[]` | no |
 | ssl\_policy | Selfink to SSL Policy | `string` | `null` | no |
 | target\_service\_accounts | List of target service accounts for health check firewall rule. Exactly one of target\_tags or target\_service\_accounts should be specified. | `list(string)` | `[]` | no |
 | target\_tags | List of target tags for health check firewall rule. Exactly one of target\_tags or target\_service\_accounts should be specified. | `list(string)` | `[]` | no |
 | url\_map | The url\_map resource to use. Default is to send all traffic to first backend. | `string` | `null` | no |
-| use\_ssl\_certificates | If true, use the certificates provided by `ssl_certificates`, otherwise, create cert from `private_key` and `certificate` | `bool` | `false` | no |
 
 ## Outputs
 
diff --git a/autogen/main.tf.tmpl b/autogen/main.tf.tmpl
index 6ec826df..cd1a5740 100644
--- a/autogen/main.tf.tmpl
+++ b/autogen/main.tf.tmpl
@@ -47,7 +47,7 @@ resource "google_compute_global_forwarding_rule" "http" {
 resource "google_compute_global_forwarding_rule" "https" {
   provider              = google-beta
   project               = var.project
-  count                 = var.ssl || var.certificate_map != null ? 1 : 0
+  count                 = var.ssl ? 1 : 0
   name                  = "${var.name}-https"
   target                = google_compute_target_https_proxy.default[0].self_link
   ip_address            = local.address
@@ -84,7 +84,7 @@ resource "google_compute_global_forwarding_rule" "http_ipv6" {
 resource "google_compute_global_forwarding_rule" "https_ipv6" {
   provider              = google-beta
   project               = var.project
-  count                 = var.enable_ipv6 && (var.ssl || var.certificate_map != null) ? 1 : 0
+  count                 = var.enable_ipv6 && var.ssl ? 1 : 0
   name                  = "${var.name}-ipv6-https"
   target                = google_compute_target_https_proxy.default[0].self_link
   ip_address            = local.ipv6_address
@@ -115,7 +115,7 @@ resource "google_compute_target_http_proxy" "default" {
 # HTTPS proxy when ssl is true
 resource "google_compute_target_https_proxy" "default" {
   project = var.project
-  count   = var.ssl || var.certificate_map != null ? 1 : 0
+  count   = var.ssl ? 1 : 0
   name    = "${var.name}-https-proxy"
   url_map = local.url_map
 
@@ -127,7 +127,7 @@ resource "google_compute_target_https_proxy" "default" {
 
 resource "google_compute_ssl_certificate" "default" {
   project     = var.project
-  count       = var.ssl && length(var.managed_ssl_certificate_domains) == 0 && !var.use_ssl_certificates ? 1 : 0
+  count       = var.ssl && var.create_ssl_certificate ? 1 : 0
   name_prefix = "${var.name}-certificate-"
   private_key = var.private_key
   certificate = var.certificate
@@ -150,7 +150,7 @@ resource "random_id" "certificate" {
 resource "google_compute_managed_ssl_certificate" "default" {
   provider = google-beta
   project  = var.project
-  count    = var.ssl && length(var.managed_ssl_certificate_domains) > 0 && !var.use_ssl_certificates ? 1 : 0
+  count    = var.ssl && length(var.managed_ssl_certificate_domains) > 0 ? 1 : 0
   name     = var.random_certificate_suffix == true ? random_id.certificate[0].hex : "${var.name}-cert"
 
   lifecycle {
diff --git a/autogen/outputs.tf.tmpl b/autogen/outputs.tf.tmpl
index c17a0ef4..7e7a8afa 100644
--- a/autogen/outputs.tf.tmpl
+++ b/autogen/outputs.tf.tmpl
@@ -49,3 +49,8 @@ output "url_map" {
   description = "The default URL map used by this module."
   value       = google_compute_url_map.default[*].self_link
 }
+
+output  "ssl_certificate" {
+  description = "The managed SSL certificates"
+  value       = google_compute_ssl_certificate.default.self_link
+}
\ No newline at end of file
diff --git a/autogen/variables.tf.tmpl b/autogen/variables.tf.tmpl
index c56ba9d9..fdc50d9c 100644
--- a/autogen/variables.tf.tmpl
+++ b/autogen/variables.tf.tmpl
@@ -215,51 +215,57 @@ variable "http_forward" {
 }
 
 variable "ssl" {
-  description = "Set to `true` to enable SSL support, requires variable `ssl_certificates` - a list of self_link certs"
+  description = "Set to `true` to enable SSL support. If `true` then at least one of these are required: 1) `ssl_certificates` OR 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  3) `managed_ssl_certificate_domains`, OR 4) `certificate_map`"
   type        = bool
   default     = false
 }
 
-variable "ssl_policy" {
-  type        = string
-  description = "Selfink to SSL Policy"
-  default     = null
+variable "create_ssl_certificate" {
+  description = "If `true`, Create certificate using `private_key/certificate`"
+  type        = bool
+  default     = false
 }
 
-variable "quic" {
-  type        = bool
-  description = "Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only."
-  default     = null
+variable "ssl_certificates" {
+  description = "SSL cert self_link list. Requires `ssl` to be set to `true`"
+  type        = list(string)
+  default     = []
 }
 
 variable "private_key" {
-  description = "Content of the private SSL key. Required if `ssl` is `true` and `ssl_certificates` is empty."
+  description = "Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`"
   type        = string
   default     = null
 }
 
 variable "certificate" {
-  description = "Content of the SSL certificate. Required if `ssl` is `true` and `ssl_certificates` is empty."
+  description = "Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`"
   type        = string
   default     = null
 }
 
 variable "managed_ssl_certificate_domains" {
-  description = "Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` and `use_ssl_certificates` set to `false`."
+  description = "Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true`"
   type        = list(string)
   default     = []
 }
 
-variable "use_ssl_certificates" {
-  description = "If true, use the certificates provided by `ssl_certificates`, otherwise, create cert from `private_key` and `certificate`"
-  type        = bool
-  default     = false
+variable "certificate_map" {
+  description = "Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true`"
+  type        = string
+  default     = null
 }
 
-variable "ssl_certificates" {
-  description = "SSL cert self_link list. Required if `ssl` is `true` and no `private_key` and `certificate` is provided."
-  type        = list(string)
-  default     = []
+variable "ssl_policy" {
+  type        = string
+  description = "Selfink to SSL Policy"
+  default     = null
+}
+
+variable "quic" {
+  type        = bool
+  description = "Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only."
+  default     = null
 }
 
 variable "edge_security_policy" {
@@ -298,12 +304,6 @@ variable "load_balancing_scheme" {
   default     = "EXTERNAL"
 }
 
-variable "certificate_map" {
-  description = "Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy"
-  type        = string
-  default     = null
-}
-
 variable "network" {
   description = "Network for INTERNAL_SELF_MANAGED load balancing scheme"
   type        = string
diff --git a/examples/certificate-map/README.md b/examples/certificate-map/README.md
new file mode 100644
index 00000000..ffb2653f
--- /dev/null
+++ b/examples/certificate-map/README.md
@@ -0,0 +1,30 @@
+# Certificate Map Example
+
+This example shows how to use certificate maps with the HTTPS Load Balancer module.
+
+## Run Terraform
+
+```
+terraform init
+terraform apply
+```
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| group1\_region | n/a | `string` | `"us-west1"` | no |
+| network\_name | n/a | `string` | `"tf-lb-https-cert-map"` | no |
+| project\_id | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| asset-url | n/a |
+| group1\_region | n/a |
+| load-balancer-ip | n/a |
+| project\_id | n/a |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/examples/certificate-map/certificate-map.tf b/examples/certificate-map/certificate-map.tf
new file mode 100644
index 00000000..78fd5218
--- /dev/null
+++ b/examples/certificate-map/certificate-map.tf
@@ -0,0 +1,45 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+  cert_map_name = "projects/${var.project_id}/locations/global/certificateMaps/certmgr-map"
+}
+
+resource "google_certificate_manager_certificate" "all" {
+  name        = "certmgr-cert"
+  description = "The default cert for all domains"
+  project     = var.project_id
+  managed {
+    domains = [
+      "test.example.com",
+    ]
+  }
+}
+
+resource "google_certificate_manager_certificate_map" "certificate_map" {
+  name        = "certmgr-map"
+  description = "My certificate map"
+  project     = var.project_id
+}
+
+resource "google_certificate_manager_certificate_map_entry" "map_entry_web1" {
+  project      = var.project_id
+  name         = "certmgr-map-entry-web1"
+  description  = "My test certificate map entry"
+  map          = google_certificate_manager_certificate_map.certificate_map.name
+  certificates = [google_certificate_manager_certificate.all.id]
+  hostname     = "test.example.com"
+}
diff --git a/examples/certificate-map/gceme.sh.tpl b/examples/certificate-map/gceme.sh.tpl
new file mode 100644
index 00000000..97b22459
--- /dev/null
+++ b/examples/certificate-map/gceme.sh.tpl
@@ -0,0 +1,127 @@
+#!/bin/bash -xe
+
+# introducing sleep so network interfaces and routes can get ready before fetching software
+sleep 10
+
+RPM_INSTALL_ARGS="install -y httpd php php-common"
+
+if [ -f "/etc/redhat-release" ]; then
+  yum update -y || dnf update -y
+  yum $RPM_INSTALL_ARGS || dnf $RPM_INSTALL_ARGS
+else
+  apt-get update
+  apt-get install -y apache2 libapache2-mod-php
+fi
+
+cat > /var/www/html/index.php <<'EOF'
+<?php
+function metadata_value($value) {
+    $opts = array(
+        "http" => array(
+            "method" => "GET",
+            "header" => "Metadata-Flavor: Google"
+        )
+    );
+    $context = stream_context_create($opts);
+    $content = file_get_contents("http://metadata/computeMetadata/v1/$value", false, $context);
+    return $content;
+}
+if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == "http") {
+		$redirect = 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+		header('HTTP/1.1 301 Moved Permanently');
+		header('Location: ' . $redirect);
+		exit();
+}
+?>
+
+<!doctype html>
+<html>
+<head>
+<!-- Compiled and minified CSS -->
+<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/materialize/0.97.0/css/materialize.min.css">
+
+<!-- Compiled and minified JavaScript -->
+<script src="https://cdnjs.cloudflare.com/ajax/libs/materialize/0.97.0/js/materialize.min.js"></script>
+<title>Frontend Web Server</title>
+</head>
+<body>
+<div class="container">
+<div class="row">
+<div class="col s2">&nbsp;</div>
+<div class="col s8">
+
+<img src="/assets/gcp-logo.svg"/>
+
+<div class="card blue">
+<div class="card-content white-text">
+<div class="card-title">Backend that serviced this request</div>
+</div>
+<div class="card-content white">
+<table class="bordered">
+  <tbody>
+	<tr>
+	  <td>Name</td>
+	  <td><?php printf(metadata_value("instance/name")) ?></td>
+	</tr>
+	<tr>
+	  <td>ID</td>
+	  <td><?php printf(metadata_value("instance/id")) ?></td>
+	</tr>
+	<tr>
+	  <td>Hostname</td>
+	  <td><?php printf(metadata_value("instance/hostname")) ?></td>
+	</tr>
+	<tr>
+	  <td>Zone</td>
+	  <td><?php printf(metadata_value("instance/zone")) ?></td>
+	</tr>
+    <tr>
+	  <td>Machine Type</td>
+	  <td><?php printf(metadata_value("instance/machine-type")) ?></td>
+	</tr>
+	<tr>
+	  <td>Project</td>
+	  <td><?php printf(metadata_value("project/project-id")) ?></td>
+	</tr>
+	<tr>
+	  <td>Internal IP</td>
+	  <td><?php printf(metadata_value("instance/network-interfaces/0/ip")) ?></td>
+	</tr>
+	<tr>
+	  <td>External IP</td>
+	  <td><?php printf(metadata_value("instance/network-interfaces/0/access-configs/0/external-ip")) ?></td>
+	</tr>
+  </tbody>
+</table>
+</div>
+</div>
+
+<div class="card blue">
+<div class="card-content white-text">
+<div class="card-title">Proxy that handled this request</div>
+</div>
+<div class="card-content white">
+<table class="bordered">
+  <tbody>
+	<tr>
+	  <td>Address</td>
+	  <td><?php printf($_SERVER["HTTP_HOST"]); ?></td>
+	</tr>
+  </tbody>
+</table>
+</div>
+
+</div>
+</div>
+<div class="col s2">&nbsp;</div>
+</div>
+</div>
+</html>
+EOF
+
+mv /var/www/html/index.html /var/www/html/index.html.old || echo "Old index doesn't exist"
+
+[[ -n "${PROXY_PATH}" ]] && mkdir -p /var/www/html/${PROXY_PATH} && cp /var/www/html/index.php /var/www/html/${PROXY_PATH}/index.php
+
+chkconfig httpd on || systemctl enable httpd || systemctl enable apache2
+service httpd restart || systemctl restart httpd || systemctl restart apache2
diff --git a/examples/certificate-map/gcp-logo.svg b/examples/certificate-map/gcp-logo.svg
new file mode 100644
index 00000000..45c38c4e
--- /dev/null
+++ b/examples/certificate-map/gcp-logo.svg
@@ -0,0 +1,142 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 286 36">
+<style type="text/css">
+.st0{fill:none;}
+.st1{clip-path:url(#SVGID_2_);}
+.st2{fill:#547DBF;}
+.st3{fill:url(#SVGID_3_);}
+.st4{fill:url(#SVGID_4_);}
+.st5{fill:#2D3079;fill-opacity:0.1;}
+.st6{fill:#FFCE40;}
+.st7{fill:url(#SVGID_5_);}
+.st8{fill:#DB4436;}
+.st9{fill:url(#SVGID_6_);}
+.st10{fill:url(#SVGID_7_);}
+.st11{fill:#3E2723;fill-opacity:5.000000e-02;}
+.st12{clip-path:url(#SVGID_9_);}
+.st13{fill:#EEEEEE;}
+.st14{clip-path:url(#SVGID_11_);}
+.st15{fill:#FFFFFF;fill-opacity:0.4;}
+.st16{fill:#262626;fill-opacity:5.000000e-02;}
+.st17{fill:#BE3A26;fill-opacity:5.000000e-02;}
+.st18{fill:#262626;fill-opacity:0.1;}
+.st19{clip-path:url(#SVGID_2_);fill:url(#SVGID_12_);}
+.st20{fill:#FFFFFF;fill-opacity:0.2;}
+.st21{fill:#BE3A26;fill-opacity:0.1;}
+.st22{fill:#3E2723;fill-opacity:0.2;}
+.st23{fill:url(#SVGID_13_);}
+.st24{opacity:0.54;}
+.st25{clip-path:url(#SVGID_15_);fill:none;}
+.st26{clip-path:url(#SVGID_15_);}
+</style>
+<symbol id="logo_x5F_dark" viewBox="0 -136 416 136">
+<path d="M0.7-52.6C0.7-23.6 25-0.1 54-0.1c16 0 27.4-6.3 36-14.5L79.8-24.7C73.7-18.9 65.4-14.4 54-14.4c-21.1 0-37.6-17-37.6-38.1 0-21.1 16.5-38.1 37.6-38.1 13.7 0 21.5 5.5 26.5 10.5 4.1 4.1 6.8 10 7.8 18H54v14.3h48.3c0.5-2.6 0.8-5.6 0.8-9 0-10.8-2.9-24.1-12.4-33.5C81.4-99.9 69.6-105 54-105 25-105 0.7-81.5 0.7-52.6zM142-37.5c-18.7 0-33.9-14.2-33.9-33.8 0-19.5 15.2-33.8 33.9-33.8 18.7 0 33.9 14.3 33.9 33.8C175.9-51.7 160.7-37.5 142-37.5zM142-91.7c-10.2 0-19.1 8.4-19.1 20.5 0 12.2 8.8 20.5 19.1 20.5 10.2 0 19.1-8.3 19.1-20.5C161.1-83.3 152.2-91.7 142-91.7zM216-37.5c-18.7 0-33.9-14.2-33.9-33.8 0-19.5 15.2-33.8 33.9-33.8 18.7 0 33.9 14.3 33.9 33.8C249.9-51.7 234.7-37.5 216-37.5zM216-91.7c-10.2 0-19.1 8.4-19.1 20.5 0 12.2 8.8 20.5 19.1 20.5s19.1-8.3 19.1-20.5C235.1-83.3 226.2-91.7 216-91.7zM306.8-39.5V-45h-0.5c-3.3 4-9.7 7.6-17.8 7.6 -16.9 0-32.4-14.8-32.4-33.9 0-18.9 15.5-33.7 32.4-33.7 8.1 0 14.5 3.6 17.8 7.7h0.5v-4.9c0-12.9-6.9-19.8-18-19.8 -9.1 0-14.7 6.5-17 12l-12.9-5.4c3.7-9 13.6-20 30-20 17.4 0 32.1 10.2 32.1 35.2v60.7H306.8zM289.8-91.7c-10.2 0-18.8 8.6-18.8 20.4 0 11.9 8.6 20.6 18.8 20.6 10.1 0 18-8.7 18-20.6C307.9-83.2 299.9-91.7 289.8-91.7z"/>
+<polygon points="346 -103 331.2 -103 331.2 -3.7 346 -3.7"/>
+<path d="M386.7-91.7c-7.6 0-12.9 3.5-16.4 10.2l45.2 18.7L414-59c-2.8 7.6-11.4 21.5-28.9 21.5 -17.4 0-31.9-13.7-31.9-33.8 0-18.9 14.3-33.8 33.5-33.8 15.5 0 24.4 9.5 28.2 15l-11.5 7.7C399.5-88 394.3-91.7 386.7-91.7zM385.6-50.5c5.9 0 10.9-2.9 12.5-7.2l-30.2-12.5C367.5-57.2 378-50.5 385.6-50.5z"/>
+<polygon class="st0" points="0 -136 416 -136 416 0 0 0"/>
+</symbol>
+<rect x="1.2" y="-0.1" class="st0" width="283.3" height="36.9"/>
+<defs>
+<path id="SVGID_1_" d="M35.5 17.2l-4.6-8.1 -2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 -2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h15c0.8 0 1.6-0.4 2-1.2l7.5-13.1C35.9 18.8 35.9 18 35.5 17.2zM18.4 23c-2.5 0-4.6-2.1-4.6-4.6s2.1-4.6 4.6-4.6 4.6 2.1 4.6 4.6S21 23 18.4 23z"/>
+</defs>
+<clipPath id="SVGID_2_">
+<use xlink:href="#SVGID_1_"/>
+</clipPath>
+<g class="st1">
+<path class="st2" d="M13.2 9.2h17.7l-2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 8.8 15.3V9.2z"/>
+<linearGradient id="SVGID_3_" gradientUnits="userSpaceOnUse" x1="7.5665" y1="17.7773" x2="15.2215" y2="13.3472">
+<stop offset="0" style="stop-color:#2D3079;stop-opacity:0.2"/>
+<stop offset="0.66" style="stop-color:#2D3079;stop-opacity:0"/>
+</linearGradient>
+<path class="st3" d="M13.2 9.2h17.7l-2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 8.8 15.3V9.2z"/>
+<linearGradient id="SVGID_4_" gradientUnits="userSpaceOnUse" x1="3.6782" y1="12.9316" x2="8.196" y2="17.4493">
+<stop offset="0" style="stop-color:#2D3079;stop-opacity:0.2"/>
+<stop offset="1" style="stop-color:#2D3079;stop-opacity:4.000000e-02"/>
+</linearGradient>
+<polygon class="st4" points="4.4 12.3 8.9 16.7 8.1 18.8 "/>
+<polygon class="st5" points="8.3 18.7 4.9 12.8 4.4 12.3 8.1 18.8 "/>
+<path class="st6" d="M13.2 27.6L4.4 12.3l-2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h9.3l8.9-15.4L13.2 27.6z"/>
+<linearGradient id="SVGID_5_" gradientUnits="userSpaceOnUse" x1="23.4972" y1="28.2559" x2="15.9109" y2="23.8142">
+<stop offset="0" style="stop-color:#BE3A26;stop-opacity:0.15"/>
+<stop offset="0.66" style="stop-color:#BE3A26;stop-opacity:0"/>
+</linearGradient>
+<path class="st7" d="M13.2 27.6L4.4 12.3l-2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h9.3l8.9-15.4L13.2 27.6z"/>
+<path class="st8" d="M30.9 9.2H13.2l15.9 9.2 -8.9 15.4H26c0.8 0 1.6-0.4 2-1.2l7.5-13.1c0.4-0.7 0.4-1.6 0-2.3L30.9 9.2z"/>
+<linearGradient id="SVGID_6_" gradientUnits="userSpaceOnUse" x1="24.5277" y1="9.4044" x2="24.5277" y2="18.2022">
+<stop offset="0" style="stop-color:#A52822;stop-opacity:0.2"/>
+<stop offset="0.66" style="stop-color:#A52822;stop-opacity:0"/>
+</linearGradient>
+<path class="st9" d="M30.9 9.2H13.2l15.9 9.2 -8.9 15.4H26c0.8 0 1.6-0.4 2-1.2l7.5-13.1c0.4-0.7 0.4-1.6 0-2.3L30.9 9.2z"/>
+<linearGradient id="SVGID_7_" gradientUnits="userSpaceOnUse" x1="18.7011" y1="18.0951" x2="30.0119" y2="29.4059">
+<stop offset="0" style="stop-color:#3E2723;stop-opacity:0.15"/>
+<stop offset="1" style="stop-color:#3E2723;stop-opacity:0"/>
+</linearGradient>
+<polygon class="st10" points="23.8 9.2 35.8 21.2 35.8 33.8 20.3 33.8 23.8 27.6 "/>
+<rect x="23.7" y="9.2" class="st11" width="7.5" height="0.2"/>
+</g>
+<g class="st1">
+<defs>
+<path id="SVGID_8_" d="M30.9 9.2H13.2l15.9 9.2 -8.9 15.4H26c0.8 0 1.6-0.4 2-1.2l7.5-13.1c0.4-0.7 0.4-1.6 0-2.3L30.9 9.2z"/>
+</defs>
+<clipPath id="SVGID_9_">
+<use xlink:href="#SVGID_8_"/>
+</clipPath>
+<g class="st12">
+<path class="st13" d="M23.8 9.2l5.3 9.2 -5.3 9.2H13.2l-5.3-9.2 5.3-9.2H23.8"/>
+</g>
+<g class="st12">
+<path class="st2" d="M13.2 9.2h17.7l-2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 8.8 15.3V9.2z"/>
+</g>
+</g>
+<g class="st1">
+<defs>
+<path id="SVGID_10_" d="M13.2 27.6L4.4 12.3l-2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h9.3l8.9-15.4L13.2 27.6z"/>
+</defs>
+<clipPath id="SVGID_11_">
+<use xlink:href="#SVGID_10_"/>
+</clipPath>
+<g class="st14">
+<path class="st13" d="M23.8 9.2l5.3 9.2 -5.3 9.2H13.2l-5.3-9.2 5.3-9.2H23.8"/>
+</g>
+</g>
+<g class="st1">
+<path class="st13" d="M23.8 9.2l5.3 9.2 -5.3 9.2H13.2l-5.3-9.2 5.3-9.2H23.8"/>
+<polygon class="st15" points="23.8 9.4 29 18.4 29.2 18.4 23.8 9.2 13.2 9.2 7.9 18.4 8 18.4 13.2 9.4 "/>
+<polygon class="st16" points="29 18.4 23.8 27.4 13.2 27.4 8 18.4 7.9 18.4 13.2 27.6 23.8 27.6 29.2 18.4 "/>
+<polygon class="st17" points="29.2 18.4 23.8 27.6 13.2 27.6 7.9 18.4 7.9 18.6 13.2 27.8 23.8 27.8 29.2 18.6 "/>
+<path class="st18" d="M18.4 13.6c-2.5 0-4.6 2.1-4.6 4.6h9.2C23.1 15.7 21 13.6 18.4 13.6zM13.8 18.6c0 2.5 2.1 4.6 4.6 4.6s4.6-2.1 4.6-4.6H13.8z"/>
+</g>
+<linearGradient id="SVGID_12_" gradientUnits="userSpaceOnUse" x1="18.5329" y1="27.6183" x2="18.5329" y2="33.7384">
+<stop offset="0" style="stop-color:#3E2723;stop-opacity:0.15"/>
+<stop offset="3.546852e-02" style="stop-color:#462823;stop-opacity:0.1447"/>
+<stop offset="0.2522" style="stop-color:#712E24;stop-opacity:0.1122"/>
+<stop offset="0.4625" style="stop-color:#923325;stop-opacity:8.062769e-02"/>
+<stop offset="0.6619" style="stop-color:#AA3726;stop-opacity:5.071827e-02"/>
+<stop offset="0.8459" style="stop-color:#B93926;stop-opacity:2.311477e-02"/>
+<stop offset="1" style="stop-color:#BE3A26;stop-opacity:0"/>
+</linearGradient>
+<polygon class="st19" points="13.2 27.6 19.4 33.8 20.3 33.8 23.8 27.6 "/>
+<g class="st1">
+<path class="st20" d="M4.4 12.5L9 4.4c0.4-0.7 1.2-1.2 2-1.2h15c0.8 0 1.6 0.4 2 1.2l2.9 5 4.6 8.1c0.2 0.3 0.3 0.7 0.3 1.1 0-0.4-0.1-0.9-0.3-1.2l-4.6-8.1 -2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 -2.9 5c-0.2 0.4-0.3 0.8-0.3 1.2 0-0.4 0.1-0.7 0.3-1.1L4.4 12.5zM11 33.6c-0.8 0-1.6-0.4-2-1.2l-4.6-8.1 -2.9-5c-0.2-0.3-0.3-0.7-0.3-1.1 0 0.4 0.1 0.9 0.3 1.2l2.9 5L9 32.6c0.4 0.7 1.2 1.2 2 1.2h9.3l0.1-0.2H11zM35.8 18.3c0 0.4-0.1 0.7-0.3 1.1l-4.6 8.1 -2.9 5c-0.4 0.7-1.2 1.2-2 1.2h-5.6l-0.1 0.2H26c0.8 0 1.6-0.4 2-1.2l2.9-5 4.6-8.1C35.7 19.2 35.8 18.7 35.8 18.3z"/>
+</g>
+<radialGradient id="SVGID_13_" cx="9.8634" cy="3.5289" r="34.5676" gradientTransform="matrix(6.457271e-03 0 0 6.457271e-03 2212.6196 -4568.3096)" gradientUnits="userSpaceOnUse">
+<stop offset="0" style="stop-color:#FFFFFF;stop-opacity:0.1"/>
+<stop offset="1" style="stop-color:#FFFFFF;stop-opacity:0"/>
+</radialGradient>
+<path class="st23" d="M35.5 17.2l-4.6-8.1 -2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 -2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h15c0.8 0 1.6-0.4 2-1.2l7.5-13.1C35.9 18.8 35.9 18 35.5 17.2zM18.4 23c-2.5 0-4.6-2.1-4.6-4.6s2.1-4.6 4.6-4.6 4.6 2.1 4.6 4.6S21 23 18.4 23z"/>
+<rect x="1.2" y="-0.1" class="st0" width="34.6" height="36.9"/>
+<g class="st24">
+<defs>
+<rect id="SVGID_14_" x="45.1" y="-0.1" class="st24" width="239.5" height="36.9"/>
+</defs>
+<clipPath id="SVGID_15_">
+<use xlink:href="#SVGID_14_"/>
+</clipPath>
+<rect x="45.1" y="7.8" class="st25" width="239.5" height="26.1"/>
+<g class="st26">
+<path d="M130.5 18.8c0-5.2 4-9.2 9.2-9.2 2.7 0 4.9 1.1 6.5 2.9l-1.6 1.5c-1.2-1.5-2.9-2.2-4.9-2.2 -3.7 0-6.8 2.7-6.8 7s3.1 7 6.8 7c2.2 0 4.1-1 5.4-2.6l1.6 1.6c-1.5 1.8-4 3.1-7 3.1C134.5 28 130.5 24.1 130.5 18.8zM148.4 27.6V10h2.3v17.6H148.4zM164.8 21.6c0 3.7-2.6 6.4-6.2 6.4 -3.6 0-6.2-2.8-6.2-6.4 0-3.7 2.6-6.4 6.2-6.4C162.2 15.2 164.8 17.9 164.8 21.6zM162.5 21.6c0-2.8-1.9-4.4-3.9-4.4 -2 0-3.9 1.6-3.9 4.4 0 2.8 1.9 4.4 3.9 4.4C160.6 25.9 162.5 24.3 162.5 21.6zM175 27.6v-1.7h-0.1c-0.7 1.1-2.2 2.1-3.8 2.1 -3.1 0-4.6-2.1-4.6-5.1v-7.4h2.3v7c0 2.5 1.3 3.4 3 3.4 2 0 3.2-1.9 3.2-3.7v-6.6h2.3v12.1H175zM179 21.6c0-3.7 2.7-6.4 5.7-6.4 1.9 0 3.4 1 4.1 2.1h0.1l-0.1-1.7V10h2.3v17.6H189v-1.7h-0.1c-0.7 1.1-2.2 2.1-4.1 2.1C181.7 28 179 25.3 179 21.6zM189 21.6c0-2.8-1.8-4.4-3.8-4.4 -2 0-3.8 1.6-3.8 4.4 0 2.7 1.8 4.4 3.8 4.4C187.1 25.9 189 24.3 189 21.6zM197.3 27.6V10h6c2.9 0 5.5 2.2 5.5 5.2s-2.6 5.2-5.5 5.2h-3.7v7.1H197.3zM203.4 18.3c2 0 3.1-1.7 3.1-3.1 0-1.4-1.1-3.1-3.1-3.1h-3.8v6.2H203.4zM210.4 27.6V10h2.3v17.6H210.4zM214.6 24c0-2.7 2.5-4.2 5.3-4.2 1.6 0 2.8 0.5 3.3 0.7v-0.3c0-1.8-1.5-2.9-3.1-2.9 -1.3 0-2.5 0.6-2.9 1.7l-2.1-0.9c0.4-1.1 1.9-2.9 4.9-2.9 3 0 5.4 1.8 5.4 5.2v7.3h-2.2v-1.7h-0.1c-0.7 1-1.9 2.1-4 2.1C216.7 28 214.6 26.5 214.6 24zM223.2 22.4c0 0-1-0.8-2.9-0.8 -2.4 0-3.3 1.3-3.3 2.4 0 1.3 1.3 1.9 2.5 1.9C221.3 25.9 223.2 24.4 223.2 22.4zM228.6 24v-6.3h-2.1v-2.1h2.1v-3.7h2.3v3.7h3v2.1h-3v6.2c0 1.4 0.6 2 1.6 2 0.4 0 0.7 0 1-0.2l0.8 1.9c-0.5 0.2-1.1 0.3-1.8 0.3C230 27.8 228.6 26.4 228.6 24zM243.3 10.2l-0.8 1.9c-0.3-0.1-0.6-0.2-1-0.2 -1.1 0-2 0.7-2 2.1v1.5h3.1v2.1h-3.1v10h-2.3v-10H235v-2.1h2.3V14c0-2.5 1.7-4.1 4.3-4.1C242.3 9.9 242.8 10 243.3 10.2zM255.7 21.6c0 3.7-2.6 6.4-6.2 6.4 -3.6 0-6.2-2.8-6.2-6.4 0-3.7 2.6-6.4 6.2-6.4C253.1 15.2 255.7 17.9 255.7 21.6zM253.4 21.6c0-2.8-1.9-4.4-3.9-4.4 -2 0-3.9 1.6-3.9 4.4 0 2.8 1.9 4.4 3.9 4.4C251.5 25.9 253.4 24.3 253.4 21.6zM257.5 27.6V15.6h2.2v2h0.1c0.5-1.4 2.2-2.3 3.5-2.3 0.7 0 1.2 0.1 1.7 0.3l-0.9 2.1c-0.3-0.1-0.7-0.2-1.2-0.2 -1.6 0-3.1 1.3-3.1 3.5v6.6H257.5zM266.2 15.6h2.2v1.7h0.1c0.7-1.2 2.3-2.1 3.7-2.1 1.9 0 3.2 0.9 3.8 2.3 0.9-1.4 2.3-2.3 4.2-2.3 3 0 4.3 2.1 4.3 5.1v7.4h-2.3v-7c0-2.5-1-3.3-2.7-3.3 -1.8 0-3.1 1.9-3.1 3.7v6.7h-2.3v-7c0-2.5-1-3.3-2.7-3.3 -1.8 0-3.1 1.9-3.1 3.7v6.7h-2.3V15.6z"/>
+</g>
+<g class="st26">
+<use xlink:href="#logo_x5F_dark" width="416" height="136" y="-136" transform="matrix(0.1922 0 0 -0.1922 45.0596 7.8192)"/>
+</g>
+</g>
+</svg>
\ No newline at end of file
diff --git a/examples/certificate-map/main.tf b/examples/certificate-map/main.tf
new file mode 100644
index 00000000..f62eefcc
--- /dev/null
+++ b/examples/certificate-map/main.tf
@@ -0,0 +1,188 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+provider "google" {
+  project = var.project_id
+}
+
+provider "google-beta" {
+  project = var.project_id
+}
+
+resource "google_compute_network" "default" {
+  name                    = var.network_name
+  auto_create_subnetworks = "false"
+}
+
+resource "google_compute_subnetwork" "group1" {
+  name                     = var.network_name
+  ip_cidr_range            = "10.125.0.0/20"
+  network                  = google_compute_network.default.self_link
+  region                   = var.group1_region
+  private_ip_google_access = true
+}
+
+# Router and Cloud NAT are required for installing packages from repos (apache, php etc)
+resource "google_compute_router" "group1" {
+  name    = "${var.network_name}-gw-group1"
+  network = google_compute_network.default.self_link
+  region  = var.group1_region
+}
+
+module "cloud-nat-group1" {
+  source     = "terraform-google-modules/cloud-nat/google"
+  version    = "~> 2.2"
+  router     = google_compute_router.group1.name
+  project_id = var.project_id
+  region     = var.group1_region
+  name       = "${var.network_name}-cloud-nat-group1"
+}
+
+resource "random_id" "assets-bucket" {
+  prefix      = "terraform-static-content-"
+  byte_length = 2
+}
+
+locals {
+  health_check = {
+    request_path = "/"
+    port         = 80
+  }
+}
+
+module "gce-lb-https" {
+  source            = "../../"
+  name              = var.network_name
+  project           = var.project_id
+  firewall_networks = [google_compute_network.default.self_link]
+  url_map           = google_compute_url_map.https-multi-cert.self_link
+  create_url_map    = false
+  ssl               = true
+  certificate_map   = local.cert_map_name
+
+  backends = {
+    default = {
+      protocol    = "HTTP"
+      port        = 80
+      port_name   = "http"
+      timeout_sec = 10
+      enable_cdn  = false
+
+      health_check = local.health_check
+      log_config = {
+        enable      = true
+        sample_rate = 1.0
+      }
+      groups = [
+        {
+          group = module.mig1.instance_group
+        },
+      ]
+
+      iap_config = {
+        enable = false
+      }
+    }
+
+    mig1 = {
+      protocol    = "HTTP"
+      port        = 80
+      port_name   = "http"
+      timeout_sec = 10
+      enable_cdn  = false
+
+      health_check = local.health_check
+      log_config = {
+        enable      = true
+        sample_rate = 1.0
+      }
+      groups = [
+        {
+          group = module.mig1.instance_group
+        },
+      ]
+
+      iap_config = {
+        enable = false
+      }
+    }
+  }
+
+  depends_on = [google_certificate_manager_certificate_map.certificate_map]
+}
+
+resource "google_compute_url_map" "https-multi-cert" {
+  // note that this is the name of the load balancer
+  name            = var.network_name
+  default_service = module.gce-lb-https.backend_services["default"].self_link
+
+  host_rule {
+    hosts        = ["*"]
+    path_matcher = "allpaths"
+  }
+
+  path_matcher {
+    name            = "allpaths"
+    default_service = module.gce-lb-https.backend_services["default"].self_link
+
+    path_rule {
+      paths = [
+        "/group1",
+        "/group1/*"
+      ]
+      service = module.gce-lb-https.backend_services["mig1"].self_link
+    }
+
+    path_rule {
+      paths = [
+        "/assets",
+        "/assets/*"
+      ]
+      service = google_compute_backend_bucket.assets.self_link
+    }
+  }
+}
+
+resource "google_compute_backend_bucket" "assets" {
+  name        = random_id.assets-bucket.hex
+  description = "Contains static resources for example app"
+  bucket_name = google_storage_bucket.assets.name
+  enable_cdn  = true
+}
+
+resource "google_storage_bucket" "assets" {
+  name     = random_id.assets-bucket.hex
+  location = "US"
+
+  // delete bucket and contents on destroy.
+  force_destroy = true
+}
+
+// The image object in Cloud Storage.
+// Note that the path in the bucket matches the paths in the url map path rule above.
+resource "google_storage_bucket_object" "image" {
+  name         = "assets/gcp-logo.svg"
+  content      = file("gcp-logo.svg")
+  content_type = "image/svg+xml"
+  bucket       = google_storage_bucket.assets.name
+}
+
+// Make object public readable.
+resource "google_storage_object_acl" "image-acl" {
+  bucket         = google_storage_bucket.assets.name
+  object         = google_storage_bucket_object.image.name
+  predefined_acl = "publicRead"
+}
diff --git a/examples/certificate-map/mig.tf b/examples/certificate-map/mig.tf
new file mode 100644
index 00000000..7e6a6ba0
--- /dev/null
+++ b/examples/certificate-map/mig.tf
@@ -0,0 +1,57 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+data "template_file" "group1-startup-script" {
+  template = file(format("%s/gceme.sh.tpl", path.module))
+
+  vars = {
+    PROXY_PATH = "/group1"
+  }
+}
+
+module "mig1_template" {
+  source     = "terraform-google-modules/vm/google//modules/instance_template"
+  version    = "~> 7.9"
+  network    = google_compute_network.default.self_link
+  subnetwork = google_compute_subnetwork.group1.self_link
+  service_account = {
+    email  = ""
+    scopes = ["cloud-platform"]
+  }
+  name_prefix          = "${var.network_name}-group1"
+  startup_script       = data.template_file.group1-startup-script.rendered
+  source_image_family  = "ubuntu-2004-lts"
+  source_image_project = "ubuntu-os-cloud"
+  tags = [
+    "${var.network_name}-group1",
+    module.cloud-nat-group1.router_name
+  ]
+}
+
+module "mig1" {
+  source            = "terraform-google-modules/vm/google//modules/mig"
+  version           = "7.9.0"
+  instance_template = module.mig1_template.self_link
+  region            = var.group1_region
+  hostname          = "${var.network_name}-group1"
+  target_size       = 2
+  named_ports = [{
+    name = "http",
+    port = 80
+  }]
+  network    = google_compute_network.default.self_link
+  subnetwork = google_compute_subnetwork.group1.self_link
+}
diff --git a/examples/certificate-map/outputs.tf b/examples/certificate-map/outputs.tf
new file mode 100644
index 00000000..5ad198e7
--- /dev/null
+++ b/examples/certificate-map/outputs.tf
@@ -0,0 +1,31 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "group1_region" {
+  value = var.group1_region
+}
+
+output "project_id" {
+  value = var.project_id
+}
+
+output "load-balancer-ip" {
+  value = module.gce-lb-https.external_ip
+}
+
+output "asset-url" {
+  value = "https://${module.gce-lb-https.external_ip}/assets/gcp-logo.svg"
+}
diff --git a/examples/certificate-map/variables.tf b/examples/certificate-map/variables.tf
new file mode 100644
index 00000000..a4223722
--- /dev/null
+++ b/examples/certificate-map/variables.tf
@@ -0,0 +1,27 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "group1_region" {
+  default = "us-west1"
+}
+
+variable "network_name" {
+  default = "tf-lb-https-cert-map"
+}
+
+variable "project_id" {
+  type = string
+}
diff --git a/examples/certificate-map/versions.tf b/examples/certificate-map/versions.tf
new file mode 100644
index 00000000..ab774560
--- /dev/null
+++ b/examples/certificate-map/versions.tf
@@ -0,0 +1,36 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_version = ">= 0.13"
+  required_providers {
+    google = {
+      source = "hashicorp/google"
+    }
+    google-beta = {
+      source = "hashicorp/google-beta"
+    }
+    random = {
+      source = "hashicorp/random"
+    }
+    template = {
+      source = "hashicorp/template"
+    }
+    tls = {
+      source = "hashicorp/tls"
+    }
+  }
+}
diff --git a/examples/user-managed-google-managed-ssl/README.md b/examples/user-managed-google-managed-ssl/README.md
new file mode 100644
index 00000000..456eecc6
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/README.md
@@ -0,0 +1,113 @@
+# Multiple Certificate Example
+
+[![button](http://gstatic.com/cloudssh/images/open-btn.png)](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/terraform-google-lb-http&working_dir=examples/multiple-certs&page=shell&tutorial=README.md)
+
+This example shows how to use multiple certificates with the HTTPS Load Balancer module.
+
+## Change to the example directory
+
+```
+[[ `basename $PWD` != multiple-certs ]] && cd examples/multiple-certs
+```
+
+## Install Terraform
+
+1. Install Terraform if it is not already installed (visit [terraform.io](https://terraform.io) for other distributions):
+
+```
+../terraform-install.sh
+```
+
+## Set up the environment
+
+1. Set the project, replace `YOUR_PROJECT` with your project ID:
+
+```
+PROJECT=YOUR_PROJECT
+```
+
+```
+gcloud config set project ${PROJECT}
+```
+
+2. Configure the environment for Terraform:
+
+```
+[[ $CLOUD_SHELL ]] || gcloud auth application-default login
+export GOOGLE_PROJECT=$(gcloud config get-value project)
+```
+
+## Run Terraform
+
+```
+terraform init
+terraform apply
+```
+
+## Testing
+
+1. Wait for the load balancer to be provisioned:
+
+```
+./test.sh
+```
+
+2. Open URL of load balancer in browser:
+
+```
+echo http://$(terraform output load-balancer-ip)| sed 's/"//g'
+```
+
+> You should see the GCP logo and instance details from the group closest to your geographical region.
+
+3. Open URL to route mapped to us-west1 instance group:
+
+```
+echo http://$(terraform output load-balancer-ip)/group1/| sed 's/"//g'
+```
+
+> You should see the GCP logo and instance details from the group in us-west1.
+
+4. Open URL to route mapped to us-central1 instance group:
+
+```
+echo http://$(terraform output load-balancer-ip)/group2/| sed 's/"//g'
+```
+
+> You should see the GCP logo and instance details from the group in us-central1.
+
+5. Open URL to route mapped to us-east1 instance group:
+
+```
+echo http://$(terraform output load-balancer-ip)/group3/| sed 's/"//g'
+```
+
+> You should see the GCP logo and instance details from the group in us-east1.
+
+## Cleanup
+
+1. Remove all resources created by terraform:
+
+```
+terraform destroy
+```
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| group1\_region | n/a | `string` | `"us-west1"` | no |
+| network\_name | n/a | `string` | `"tf-lb-user-goog-ssl"` | no |
+| project\_id | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| asset-url | n/a |
+| group1\_region | n/a |
+| load-balancer-ip | n/a |
+| project\_id | n/a |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/examples/user-managed-google-managed-ssl/gceme.sh.tpl b/examples/user-managed-google-managed-ssl/gceme.sh.tpl
new file mode 120000
index 00000000..7934e83e
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/gceme.sh.tpl
@@ -0,0 +1 @@
+../multi-backend-multi-mig-bucket-https-lb/gceme.sh.tpl
\ No newline at end of file
diff --git a/examples/user-managed-google-managed-ssl/gcp-logo.svg b/examples/user-managed-google-managed-ssl/gcp-logo.svg
new file mode 100644
index 00000000..45c38c4e
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/gcp-logo.svg
@@ -0,0 +1,142 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 286 36">
+<style type="text/css">
+.st0{fill:none;}
+.st1{clip-path:url(#SVGID_2_);}
+.st2{fill:#547DBF;}
+.st3{fill:url(#SVGID_3_);}
+.st4{fill:url(#SVGID_4_);}
+.st5{fill:#2D3079;fill-opacity:0.1;}
+.st6{fill:#FFCE40;}
+.st7{fill:url(#SVGID_5_);}
+.st8{fill:#DB4436;}
+.st9{fill:url(#SVGID_6_);}
+.st10{fill:url(#SVGID_7_);}
+.st11{fill:#3E2723;fill-opacity:5.000000e-02;}
+.st12{clip-path:url(#SVGID_9_);}
+.st13{fill:#EEEEEE;}
+.st14{clip-path:url(#SVGID_11_);}
+.st15{fill:#FFFFFF;fill-opacity:0.4;}
+.st16{fill:#262626;fill-opacity:5.000000e-02;}
+.st17{fill:#BE3A26;fill-opacity:5.000000e-02;}
+.st18{fill:#262626;fill-opacity:0.1;}
+.st19{clip-path:url(#SVGID_2_);fill:url(#SVGID_12_);}
+.st20{fill:#FFFFFF;fill-opacity:0.2;}
+.st21{fill:#BE3A26;fill-opacity:0.1;}
+.st22{fill:#3E2723;fill-opacity:0.2;}
+.st23{fill:url(#SVGID_13_);}
+.st24{opacity:0.54;}
+.st25{clip-path:url(#SVGID_15_);fill:none;}
+.st26{clip-path:url(#SVGID_15_);}
+</style>
+<symbol id="logo_x5F_dark" viewBox="0 -136 416 136">
+<path d="M0.7-52.6C0.7-23.6 25-0.1 54-0.1c16 0 27.4-6.3 36-14.5L79.8-24.7C73.7-18.9 65.4-14.4 54-14.4c-21.1 0-37.6-17-37.6-38.1 0-21.1 16.5-38.1 37.6-38.1 13.7 0 21.5 5.5 26.5 10.5 4.1 4.1 6.8 10 7.8 18H54v14.3h48.3c0.5-2.6 0.8-5.6 0.8-9 0-10.8-2.9-24.1-12.4-33.5C81.4-99.9 69.6-105 54-105 25-105 0.7-81.5 0.7-52.6zM142-37.5c-18.7 0-33.9-14.2-33.9-33.8 0-19.5 15.2-33.8 33.9-33.8 18.7 0 33.9 14.3 33.9 33.8C175.9-51.7 160.7-37.5 142-37.5zM142-91.7c-10.2 0-19.1 8.4-19.1 20.5 0 12.2 8.8 20.5 19.1 20.5 10.2 0 19.1-8.3 19.1-20.5C161.1-83.3 152.2-91.7 142-91.7zM216-37.5c-18.7 0-33.9-14.2-33.9-33.8 0-19.5 15.2-33.8 33.9-33.8 18.7 0 33.9 14.3 33.9 33.8C249.9-51.7 234.7-37.5 216-37.5zM216-91.7c-10.2 0-19.1 8.4-19.1 20.5 0 12.2 8.8 20.5 19.1 20.5s19.1-8.3 19.1-20.5C235.1-83.3 226.2-91.7 216-91.7zM306.8-39.5V-45h-0.5c-3.3 4-9.7 7.6-17.8 7.6 -16.9 0-32.4-14.8-32.4-33.9 0-18.9 15.5-33.7 32.4-33.7 8.1 0 14.5 3.6 17.8 7.7h0.5v-4.9c0-12.9-6.9-19.8-18-19.8 -9.1 0-14.7 6.5-17 12l-12.9-5.4c3.7-9 13.6-20 30-20 17.4 0 32.1 10.2 32.1 35.2v60.7H306.8zM289.8-91.7c-10.2 0-18.8 8.6-18.8 20.4 0 11.9 8.6 20.6 18.8 20.6 10.1 0 18-8.7 18-20.6C307.9-83.2 299.9-91.7 289.8-91.7z"/>
+<polygon points="346 -103 331.2 -103 331.2 -3.7 346 -3.7"/>
+<path d="M386.7-91.7c-7.6 0-12.9 3.5-16.4 10.2l45.2 18.7L414-59c-2.8 7.6-11.4 21.5-28.9 21.5 -17.4 0-31.9-13.7-31.9-33.8 0-18.9 14.3-33.8 33.5-33.8 15.5 0 24.4 9.5 28.2 15l-11.5 7.7C399.5-88 394.3-91.7 386.7-91.7zM385.6-50.5c5.9 0 10.9-2.9 12.5-7.2l-30.2-12.5C367.5-57.2 378-50.5 385.6-50.5z"/>
+<polygon class="st0" points="0 -136 416 -136 416 0 0 0"/>
+</symbol>
+<rect x="1.2" y="-0.1" class="st0" width="283.3" height="36.9"/>
+<defs>
+<path id="SVGID_1_" d="M35.5 17.2l-4.6-8.1 -2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 -2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h15c0.8 0 1.6-0.4 2-1.2l7.5-13.1C35.9 18.8 35.9 18 35.5 17.2zM18.4 23c-2.5 0-4.6-2.1-4.6-4.6s2.1-4.6 4.6-4.6 4.6 2.1 4.6 4.6S21 23 18.4 23z"/>
+</defs>
+<clipPath id="SVGID_2_">
+<use xlink:href="#SVGID_1_"/>
+</clipPath>
+<g class="st1">
+<path class="st2" d="M13.2 9.2h17.7l-2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 8.8 15.3V9.2z"/>
+<linearGradient id="SVGID_3_" gradientUnits="userSpaceOnUse" x1="7.5665" y1="17.7773" x2="15.2215" y2="13.3472">
+<stop offset="0" style="stop-color:#2D3079;stop-opacity:0.2"/>
+<stop offset="0.66" style="stop-color:#2D3079;stop-opacity:0"/>
+</linearGradient>
+<path class="st3" d="M13.2 9.2h17.7l-2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 8.8 15.3V9.2z"/>
+<linearGradient id="SVGID_4_" gradientUnits="userSpaceOnUse" x1="3.6782" y1="12.9316" x2="8.196" y2="17.4493">
+<stop offset="0" style="stop-color:#2D3079;stop-opacity:0.2"/>
+<stop offset="1" style="stop-color:#2D3079;stop-opacity:4.000000e-02"/>
+</linearGradient>
+<polygon class="st4" points="4.4 12.3 8.9 16.7 8.1 18.8 "/>
+<polygon class="st5" points="8.3 18.7 4.9 12.8 4.4 12.3 8.1 18.8 "/>
+<path class="st6" d="M13.2 27.6L4.4 12.3l-2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h9.3l8.9-15.4L13.2 27.6z"/>
+<linearGradient id="SVGID_5_" gradientUnits="userSpaceOnUse" x1="23.4972" y1="28.2559" x2="15.9109" y2="23.8142">
+<stop offset="0" style="stop-color:#BE3A26;stop-opacity:0.15"/>
+<stop offset="0.66" style="stop-color:#BE3A26;stop-opacity:0"/>
+</linearGradient>
+<path class="st7" d="M13.2 27.6L4.4 12.3l-2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h9.3l8.9-15.4L13.2 27.6z"/>
+<path class="st8" d="M30.9 9.2H13.2l15.9 9.2 -8.9 15.4H26c0.8 0 1.6-0.4 2-1.2l7.5-13.1c0.4-0.7 0.4-1.6 0-2.3L30.9 9.2z"/>
+<linearGradient id="SVGID_6_" gradientUnits="userSpaceOnUse" x1="24.5277" y1="9.4044" x2="24.5277" y2="18.2022">
+<stop offset="0" style="stop-color:#A52822;stop-opacity:0.2"/>
+<stop offset="0.66" style="stop-color:#A52822;stop-opacity:0"/>
+</linearGradient>
+<path class="st9" d="M30.9 9.2H13.2l15.9 9.2 -8.9 15.4H26c0.8 0 1.6-0.4 2-1.2l7.5-13.1c0.4-0.7 0.4-1.6 0-2.3L30.9 9.2z"/>
+<linearGradient id="SVGID_7_" gradientUnits="userSpaceOnUse" x1="18.7011" y1="18.0951" x2="30.0119" y2="29.4059">
+<stop offset="0" style="stop-color:#3E2723;stop-opacity:0.15"/>
+<stop offset="1" style="stop-color:#3E2723;stop-opacity:0"/>
+</linearGradient>
+<polygon class="st10" points="23.8 9.2 35.8 21.2 35.8 33.8 20.3 33.8 23.8 27.6 "/>
+<rect x="23.7" y="9.2" class="st11" width="7.5" height="0.2"/>
+</g>
+<g class="st1">
+<defs>
+<path id="SVGID_8_" d="M30.9 9.2H13.2l15.9 9.2 -8.9 15.4H26c0.8 0 1.6-0.4 2-1.2l7.5-13.1c0.4-0.7 0.4-1.6 0-2.3L30.9 9.2z"/>
+</defs>
+<clipPath id="SVGID_9_">
+<use xlink:href="#SVGID_8_"/>
+</clipPath>
+<g class="st12">
+<path class="st13" d="M23.8 9.2l5.3 9.2 -5.3 9.2H13.2l-5.3-9.2 5.3-9.2H23.8"/>
+</g>
+<g class="st12">
+<path class="st2" d="M13.2 9.2h17.7l-2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 8.8 15.3V9.2z"/>
+</g>
+</g>
+<g class="st1">
+<defs>
+<path id="SVGID_10_" d="M13.2 27.6L4.4 12.3l-2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h9.3l8.9-15.4L13.2 27.6z"/>
+</defs>
+<clipPath id="SVGID_11_">
+<use xlink:href="#SVGID_10_"/>
+</clipPath>
+<g class="st14">
+<path class="st13" d="M23.8 9.2l5.3 9.2 -5.3 9.2H13.2l-5.3-9.2 5.3-9.2H23.8"/>
+</g>
+</g>
+<g class="st1">
+<path class="st13" d="M23.8 9.2l5.3 9.2 -5.3 9.2H13.2l-5.3-9.2 5.3-9.2H23.8"/>
+<polygon class="st15" points="23.8 9.4 29 18.4 29.2 18.4 23.8 9.2 13.2 9.2 7.9 18.4 8 18.4 13.2 9.4 "/>
+<polygon class="st16" points="29 18.4 23.8 27.4 13.2 27.4 8 18.4 7.9 18.4 13.2 27.6 23.8 27.6 29.2 18.4 "/>
+<polygon class="st17" points="29.2 18.4 23.8 27.6 13.2 27.6 7.9 18.4 7.9 18.6 13.2 27.8 23.8 27.8 29.2 18.6 "/>
+<path class="st18" d="M18.4 13.6c-2.5 0-4.6 2.1-4.6 4.6h9.2C23.1 15.7 21 13.6 18.4 13.6zM13.8 18.6c0 2.5 2.1 4.6 4.6 4.6s4.6-2.1 4.6-4.6H13.8z"/>
+</g>
+<linearGradient id="SVGID_12_" gradientUnits="userSpaceOnUse" x1="18.5329" y1="27.6183" x2="18.5329" y2="33.7384">
+<stop offset="0" style="stop-color:#3E2723;stop-opacity:0.15"/>
+<stop offset="3.546852e-02" style="stop-color:#462823;stop-opacity:0.1447"/>
+<stop offset="0.2522" style="stop-color:#712E24;stop-opacity:0.1122"/>
+<stop offset="0.4625" style="stop-color:#923325;stop-opacity:8.062769e-02"/>
+<stop offset="0.6619" style="stop-color:#AA3726;stop-opacity:5.071827e-02"/>
+<stop offset="0.8459" style="stop-color:#B93926;stop-opacity:2.311477e-02"/>
+<stop offset="1" style="stop-color:#BE3A26;stop-opacity:0"/>
+</linearGradient>
+<polygon class="st19" points="13.2 27.6 19.4 33.8 20.3 33.8 23.8 27.6 "/>
+<g class="st1">
+<path class="st20" d="M4.4 12.5L9 4.4c0.4-0.7 1.2-1.2 2-1.2h15c0.8 0 1.6 0.4 2 1.2l2.9 5 4.6 8.1c0.2 0.3 0.3 0.7 0.3 1.1 0-0.4-0.1-0.9-0.3-1.2l-4.6-8.1 -2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 -2.9 5c-0.2 0.4-0.3 0.8-0.3 1.2 0-0.4 0.1-0.7 0.3-1.1L4.4 12.5zM11 33.6c-0.8 0-1.6-0.4-2-1.2l-4.6-8.1 -2.9-5c-0.2-0.3-0.3-0.7-0.3-1.1 0 0.4 0.1 0.9 0.3 1.2l2.9 5L9 32.6c0.4 0.7 1.2 1.2 2 1.2h9.3l0.1-0.2H11zM35.8 18.3c0 0.4-0.1 0.7-0.3 1.1l-4.6 8.1 -2.9 5c-0.4 0.7-1.2 1.2-2 1.2h-5.6l-0.1 0.2H26c0.8 0 1.6-0.4 2-1.2l2.9-5 4.6-8.1C35.7 19.2 35.8 18.7 35.8 18.3z"/>
+</g>
+<radialGradient id="SVGID_13_" cx="9.8634" cy="3.5289" r="34.5676" gradientTransform="matrix(6.457271e-03 0 0 6.457271e-03 2212.6196 -4568.3096)" gradientUnits="userSpaceOnUse">
+<stop offset="0" style="stop-color:#FFFFFF;stop-opacity:0.1"/>
+<stop offset="1" style="stop-color:#FFFFFF;stop-opacity:0"/>
+</radialGradient>
+<path class="st23" d="M35.5 17.2l-4.6-8.1 -2.9-5C27.6 3.5 26.9 3 26 3H11c-0.8 0-1.6 0.4-2 1.2l-4.6 8.1 -2.9 5c-0.4 0.7-0.4 1.6 0 2.3L9 32.6c0.4 0.7 1.2 1.2 2 1.2h15c0.8 0 1.6-0.4 2-1.2l7.5-13.1C35.9 18.8 35.9 18 35.5 17.2zM18.4 23c-2.5 0-4.6-2.1-4.6-4.6s2.1-4.6 4.6-4.6 4.6 2.1 4.6 4.6S21 23 18.4 23z"/>
+<rect x="1.2" y="-0.1" class="st0" width="34.6" height="36.9"/>
+<g class="st24">
+<defs>
+<rect id="SVGID_14_" x="45.1" y="-0.1" class="st24" width="239.5" height="36.9"/>
+</defs>
+<clipPath id="SVGID_15_">
+<use xlink:href="#SVGID_14_"/>
+</clipPath>
+<rect x="45.1" y="7.8" class="st25" width="239.5" height="26.1"/>
+<g class="st26">
+<path d="M130.5 18.8c0-5.2 4-9.2 9.2-9.2 2.7 0 4.9 1.1 6.5 2.9l-1.6 1.5c-1.2-1.5-2.9-2.2-4.9-2.2 -3.7 0-6.8 2.7-6.8 7s3.1 7 6.8 7c2.2 0 4.1-1 5.4-2.6l1.6 1.6c-1.5 1.8-4 3.1-7 3.1C134.5 28 130.5 24.1 130.5 18.8zM148.4 27.6V10h2.3v17.6H148.4zM164.8 21.6c0 3.7-2.6 6.4-6.2 6.4 -3.6 0-6.2-2.8-6.2-6.4 0-3.7 2.6-6.4 6.2-6.4C162.2 15.2 164.8 17.9 164.8 21.6zM162.5 21.6c0-2.8-1.9-4.4-3.9-4.4 -2 0-3.9 1.6-3.9 4.4 0 2.8 1.9 4.4 3.9 4.4C160.6 25.9 162.5 24.3 162.5 21.6zM175 27.6v-1.7h-0.1c-0.7 1.1-2.2 2.1-3.8 2.1 -3.1 0-4.6-2.1-4.6-5.1v-7.4h2.3v7c0 2.5 1.3 3.4 3 3.4 2 0 3.2-1.9 3.2-3.7v-6.6h2.3v12.1H175zM179 21.6c0-3.7 2.7-6.4 5.7-6.4 1.9 0 3.4 1 4.1 2.1h0.1l-0.1-1.7V10h2.3v17.6H189v-1.7h-0.1c-0.7 1.1-2.2 2.1-4.1 2.1C181.7 28 179 25.3 179 21.6zM189 21.6c0-2.8-1.8-4.4-3.8-4.4 -2 0-3.8 1.6-3.8 4.4 0 2.7 1.8 4.4 3.8 4.4C187.1 25.9 189 24.3 189 21.6zM197.3 27.6V10h6c2.9 0 5.5 2.2 5.5 5.2s-2.6 5.2-5.5 5.2h-3.7v7.1H197.3zM203.4 18.3c2 0 3.1-1.7 3.1-3.1 0-1.4-1.1-3.1-3.1-3.1h-3.8v6.2H203.4zM210.4 27.6V10h2.3v17.6H210.4zM214.6 24c0-2.7 2.5-4.2 5.3-4.2 1.6 0 2.8 0.5 3.3 0.7v-0.3c0-1.8-1.5-2.9-3.1-2.9 -1.3 0-2.5 0.6-2.9 1.7l-2.1-0.9c0.4-1.1 1.9-2.9 4.9-2.9 3 0 5.4 1.8 5.4 5.2v7.3h-2.2v-1.7h-0.1c-0.7 1-1.9 2.1-4 2.1C216.7 28 214.6 26.5 214.6 24zM223.2 22.4c0 0-1-0.8-2.9-0.8 -2.4 0-3.3 1.3-3.3 2.4 0 1.3 1.3 1.9 2.5 1.9C221.3 25.9 223.2 24.4 223.2 22.4zM228.6 24v-6.3h-2.1v-2.1h2.1v-3.7h2.3v3.7h3v2.1h-3v6.2c0 1.4 0.6 2 1.6 2 0.4 0 0.7 0 1-0.2l0.8 1.9c-0.5 0.2-1.1 0.3-1.8 0.3C230 27.8 228.6 26.4 228.6 24zM243.3 10.2l-0.8 1.9c-0.3-0.1-0.6-0.2-1-0.2 -1.1 0-2 0.7-2 2.1v1.5h3.1v2.1h-3.1v10h-2.3v-10H235v-2.1h2.3V14c0-2.5 1.7-4.1 4.3-4.1C242.3 9.9 242.8 10 243.3 10.2zM255.7 21.6c0 3.7-2.6 6.4-6.2 6.4 -3.6 0-6.2-2.8-6.2-6.4 0-3.7 2.6-6.4 6.2-6.4C253.1 15.2 255.7 17.9 255.7 21.6zM253.4 21.6c0-2.8-1.9-4.4-3.9-4.4 -2 0-3.9 1.6-3.9 4.4 0 2.8 1.9 4.4 3.9 4.4C251.5 25.9 253.4 24.3 253.4 21.6zM257.5 27.6V15.6h2.2v2h0.1c0.5-1.4 2.2-2.3 3.5-2.3 0.7 0 1.2 0.1 1.7 0.3l-0.9 2.1c-0.3-0.1-0.7-0.2-1.2-0.2 -1.6 0-3.1 1.3-3.1 3.5v6.6H257.5zM266.2 15.6h2.2v1.7h0.1c0.7-1.2 2.3-2.1 3.7-2.1 1.9 0 3.2 0.9 3.8 2.3 0.9-1.4 2.3-2.3 4.2-2.3 3 0 4.3 2.1 4.3 5.1v7.4h-2.3v-7c0-2.5-1-3.3-2.7-3.3 -1.8 0-3.1 1.9-3.1 3.7v6.7h-2.3v-7c0-2.5-1-3.3-2.7-3.3 -1.8 0-3.1 1.9-3.1 3.7v6.7h-2.3V15.6z"/>
+</g>
+<g class="st26">
+<use xlink:href="#logo_x5F_dark" width="416" height="136" y="-136" transform="matrix(0.1922 0 0 -0.1922 45.0596 7.8192)"/>
+</g>
+</g>
+</svg>
\ No newline at end of file
diff --git a/examples/user-managed-google-managed-ssl/main.tf b/examples/user-managed-google-managed-ssl/main.tf
new file mode 100644
index 00000000..a6b5036c
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/main.tf
@@ -0,0 +1,192 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+provider "google" {
+  project = var.project_id
+}
+
+provider "google-beta" {
+  project = var.project_id
+}
+
+resource "google_compute_network" "default" {
+  name                    = var.network_name
+  auto_create_subnetworks = "false"
+}
+
+resource "google_compute_subnetwork" "group1" {
+  name                     = var.network_name
+  ip_cidr_range            = "10.125.0.0/20"
+  network                  = google_compute_network.default.self_link
+  region                   = var.group1_region
+  private_ip_google_access = true
+}
+
+# Router and Cloud NAT are required for installing packages from repos (apache, php etc)
+resource "google_compute_router" "group1" {
+  name    = "${var.network_name}-gw-group1"
+  network = google_compute_network.default.self_link
+  region  = var.group1_region
+}
+
+module "cloud-nat-group1" {
+  source     = "terraform-google-modules/cloud-nat/google"
+  version    = "~> 2.2"
+  router     = google_compute_router.group1.name
+  project_id = var.project_id
+  region     = var.group1_region
+  name       = "${var.network_name}-cloud-nat-group1"
+}
+
+resource "random_id" "assets-bucket" {
+  prefix      = "terraform-static-content-"
+  byte_length = 2
+}
+
+locals {
+  health_check = {
+    request_path = "/"
+    port         = 80
+  }
+}
+
+module "gce-lb-https" {
+  source                          = "../../"
+  name                            = var.network_name
+  project                         = var.project_id
+  firewall_networks               = [google_compute_network.default.self_link]
+  url_map                         = google_compute_url_map.https-multi-cert.self_link
+  create_url_map                  = false
+  ssl                             = true
+  create_ssl_certificate          = true
+  private_key                     = tls_private_key.single_key.private_key_pem
+  certificate                     = tls_self_signed_cert.single_cert.cert_pem
+  managed_ssl_certificate_domains = ["test.example.com"]
+  ssl_certificates                = google_compute_ssl_certificate.example.*.self_link
+
+  backends = {
+    default = {
+      protocol    = "HTTP"
+      port        = 80
+      port_name   = "http"
+      timeout_sec = 10
+      enable_cdn  = false
+
+      health_check = local.health_check
+      log_config = {
+        enable      = true
+        sample_rate = 1.0
+      }
+      groups = [
+        {
+          group = module.mig1.instance_group
+        },
+      ]
+
+      iap_config = {
+        enable = false
+      }
+    }
+
+    mig1 = {
+      protocol    = "HTTP"
+      port        = 80
+      port_name   = "http"
+      timeout_sec = 10
+      enable_cdn  = false
+
+      health_check = local.health_check
+      log_config = {
+        enable      = true
+        sample_rate = 1.0
+      }
+      groups = [
+        {
+          group = module.mig1.instance_group
+        },
+      ]
+
+      iap_config = {
+        enable = false
+      }
+    }
+  }
+
+  # depends_on = [google_certificate_manager_certificate_map.certificate_map]
+}
+
+resource "google_compute_url_map" "https-multi-cert" {
+  // note that this is the name of the load balancer
+  name            = var.network_name
+  default_service = module.gce-lb-https.backend_services["default"].self_link
+
+  host_rule {
+    hosts        = ["*"]
+    path_matcher = "allpaths"
+  }
+
+  path_matcher {
+    name            = "allpaths"
+    default_service = module.gce-lb-https.backend_services["default"].self_link
+
+    path_rule {
+      paths = [
+        "/group1",
+        "/group1/*"
+      ]
+      service = module.gce-lb-https.backend_services["mig1"].self_link
+    }
+
+    path_rule {
+      paths = [
+        "/assets",
+        "/assets/*"
+      ]
+      service = google_compute_backend_bucket.assets.self_link
+    }
+  }
+}
+
+resource "google_compute_backend_bucket" "assets" {
+  name        = random_id.assets-bucket.hex
+  description = "Contains static resources for example app"
+  bucket_name = google_storage_bucket.assets.name
+  enable_cdn  = true
+}
+
+resource "google_storage_bucket" "assets" {
+  name     = random_id.assets-bucket.hex
+  location = "US"
+
+  // delete bucket and contents on destroy.
+  force_destroy = true
+}
+
+// The image object in Cloud Storage.
+// Note that the path in the bucket matches the paths in the url map path rule above.
+resource "google_storage_bucket_object" "image" {
+  name         = "assets/gcp-logo.svg"
+  content      = file("gcp-logo.svg")
+  content_type = "image/svg+xml"
+  bucket       = google_storage_bucket.assets.name
+}
+
+// Make object public readable.
+resource "google_storage_object_acl" "image-acl" {
+  bucket         = google_storage_bucket.assets.name
+  object         = google_storage_bucket_object.image.name
+  predefined_acl = "publicRead"
+}
diff --git a/examples/user-managed-google-managed-ssl/mig.tf b/examples/user-managed-google-managed-ssl/mig.tf
new file mode 100644
index 00000000..7e6a6ba0
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/mig.tf
@@ -0,0 +1,57 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+data "template_file" "group1-startup-script" {
+  template = file(format("%s/gceme.sh.tpl", path.module))
+
+  vars = {
+    PROXY_PATH = "/group1"
+  }
+}
+
+module "mig1_template" {
+  source     = "terraform-google-modules/vm/google//modules/instance_template"
+  version    = "~> 7.9"
+  network    = google_compute_network.default.self_link
+  subnetwork = google_compute_subnetwork.group1.self_link
+  service_account = {
+    email  = ""
+    scopes = ["cloud-platform"]
+  }
+  name_prefix          = "${var.network_name}-group1"
+  startup_script       = data.template_file.group1-startup-script.rendered
+  source_image_family  = "ubuntu-2004-lts"
+  source_image_project = "ubuntu-os-cloud"
+  tags = [
+    "${var.network_name}-group1",
+    module.cloud-nat-group1.router_name
+  ]
+}
+
+module "mig1" {
+  source            = "terraform-google-modules/vm/google//modules/mig"
+  version           = "7.9.0"
+  instance_template = module.mig1_template.self_link
+  region            = var.group1_region
+  hostname          = "${var.network_name}-group1"
+  target_size       = 2
+  named_ports = [{
+    name = "http",
+    port = 80
+  }]
+  network    = google_compute_network.default.self_link
+  subnetwork = google_compute_subnetwork.group1.self_link
+}
diff --git a/examples/user-managed-google-managed-ssl/outputs.tf b/examples/user-managed-google-managed-ssl/outputs.tf
new file mode 100644
index 00000000..5ad198e7
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/outputs.tf
@@ -0,0 +1,31 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "group1_region" {
+  value = var.group1_region
+}
+
+output "project_id" {
+  value = var.project_id
+}
+
+output "load-balancer-ip" {
+  value = module.gce-lb-https.external_ip
+}
+
+output "asset-url" {
+  value = "https://${module.gce-lb-https.external_ip}/assets/gcp-logo.svg"
+}
diff --git a/examples/user-managed-google-managed-ssl/tls.tf b/examples/user-managed-google-managed-ssl/tls.tf
new file mode 100644
index 00000000..373e4e4f
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/tls.tf
@@ -0,0 +1,84 @@
+/**
+ * Copyright 2017 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+resource "tls_private_key" "example" {
+  count     = 3
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "tls_self_signed_cert" "example" {
+  count           = 3
+  private_key_pem = tls_private_key.example[count.index].private_key_pem
+
+  # Certificate expires after 12 hours.
+  validity_period_hours = 12
+
+  # Generate a new certificate if Terraform is run within three
+  # hours of the certificate's expiration time.
+  early_renewal_hours = 3
+
+  # Reasonable set of uses for a server SSL certificate.
+  allowed_uses = [
+    "key_encipherment",
+    "digital_signature",
+    "server_auth",
+  ]
+
+  dns_names = ["example-${count.index + 1}.com"]
+
+  subject {
+    common_name  = "example-${count.index + 1}.com"
+    organization = "ACME Examples, Inc"
+  }
+}
+
+resource "google_compute_ssl_certificate" "example" {
+  count       = 3
+  name        = "${var.network_name}-cert-${count.index + 1}"
+  private_key = tls_private_key.example[count.index].private_key_pem
+  certificate = tls_self_signed_cert.example[count.index].cert_pem
+}
+
+resource "tls_private_key" "single_key" {
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "tls_self_signed_cert" "single_cert" {
+  private_key_pem = tls_private_key.single_key.private_key_pem
+
+  # Certificate expires after 12 hours.
+  validity_period_hours = 12
+
+  # Generate a new certificate if Terraform is run within three
+  # hours of the certificate's expiration time.
+  early_renewal_hours = 3
+
+  # Reasonable set of uses for a server SSL certificate.
+  allowed_uses = [
+    "key_encipherment",
+    "digital_signature",
+    "server_auth",
+  ]
+
+  dns_names = ["example-single.com"]
+
+  subject {
+    common_name  = "example-single.com"
+    organization = "ACME Examples, Inc"
+  }
+}
diff --git a/examples/user-managed-google-managed-ssl/variables.tf b/examples/user-managed-google-managed-ssl/variables.tf
new file mode 100644
index 00000000..704756ce
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/variables.tf
@@ -0,0 +1,27 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "group1_region" {
+  default = "us-west1"
+}
+
+variable "network_name" {
+  default = "tf-lb-user-goog-ssl"
+}
+
+variable "project_id" {
+  type = string
+}
diff --git a/examples/user-managed-google-managed-ssl/versions.tf b/examples/user-managed-google-managed-ssl/versions.tf
new file mode 100644
index 00000000..80aa2254
--- /dev/null
+++ b/examples/user-managed-google-managed-ssl/versions.tf
@@ -0,0 +1,36 @@
+/**
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_version = ">= 0.13"
+  required_providers {
+    google = {
+      source = "hashicorp/google"
+    }
+    google-beta = {
+      source = "hashicorp/google-beta"
+    }
+    random = {
+      source = "hashicorp/random"
+    }
+    template = {
+      source = "hashicorp/template"
+    }
+    tls = {
+      source = "hashicorp/tls"
+    }
+  }
+}
diff --git a/main.tf b/main.tf
index 48fe72ac..660a63ef 100644
--- a/main.tf
+++ b/main.tf
@@ -45,7 +45,7 @@ resource "google_compute_global_forwarding_rule" "http" {
 resource "google_compute_global_forwarding_rule" "https" {
   provider              = google-beta
   project               = var.project
-  count                 = var.ssl || var.certificate_map != null ? 1 : 0
+  count                 = var.ssl ? 1 : 0
   name                  = "${var.name}-https"
   target                = google_compute_target_https_proxy.default[0].self_link
   ip_address            = local.address
@@ -82,7 +82,7 @@ resource "google_compute_global_forwarding_rule" "http_ipv6" {
 resource "google_compute_global_forwarding_rule" "https_ipv6" {
   provider              = google-beta
   project               = var.project
-  count                 = var.enable_ipv6 && (var.ssl || var.certificate_map != null) ? 1 : 0
+  count                 = var.enable_ipv6 && var.ssl ? 1 : 0
   name                  = "${var.name}-ipv6-https"
   target                = google_compute_target_https_proxy.default[0].self_link
   ip_address            = local.ipv6_address
@@ -113,7 +113,7 @@ resource "google_compute_target_http_proxy" "default" {
 # HTTPS proxy when ssl is true
 resource "google_compute_target_https_proxy" "default" {
   project = var.project
-  count   = var.ssl || var.certificate_map != null ? 1 : 0
+  count   = var.ssl ? 1 : 0
   name    = "${var.name}-https-proxy"
   url_map = local.url_map
 
@@ -125,7 +125,7 @@ resource "google_compute_target_https_proxy" "default" {
 
 resource "google_compute_ssl_certificate" "default" {
   project     = var.project
-  count       = var.ssl && length(var.managed_ssl_certificate_domains) == 0 && !var.use_ssl_certificates ? 1 : 0
+  count       = var.ssl && var.create_ssl_certificate ? 1 : 0
   name_prefix = "${var.name}-certificate-"
   private_key = var.private_key
   certificate = var.certificate
@@ -148,7 +148,7 @@ resource "random_id" "certificate" {
 resource "google_compute_managed_ssl_certificate" "default" {
   provider = google-beta
   project  = var.project
-  count    = var.ssl && length(var.managed_ssl_certificate_domains) > 0 && !var.use_ssl_certificates ? 1 : 0
+  count    = var.ssl && length(var.managed_ssl_certificate_domains) > 0 ? 1 : 0
   name     = var.random_certificate_suffix == true ? random_id.certificate[0].hex : "${var.name}-cert"
 
   lifecycle {
diff --git a/modules/dynamic_backends/README.md b/modules/dynamic_backends/README.md
index 658b767b..a10c39db 100644
--- a/modules/dynamic_backends/README.md
+++ b/modules/dynamic_backends/README.md
@@ -113,11 +113,12 @@ module "gce-lb-http" {
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | address | Existing IPv4 address to use (the actual IP address value) | `string` | `null` | no |
-| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    port                    = optional(number)<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    timeout_sec                     = optional(number)<br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br>    health_check = object({<br>      host                = optional(string)<br>      request_path        = optional(string)<br>      request             = optional(string)<br>      response            = optional(string)<br>      port                = optional(number)<br>      port_name           = optional(string)<br>      proxy_header        = optional(string)<br>      port_specification  = optional(string)<br>      protocol            = optional(string)<br>      check_interval_sec  = optional(number)<br>      timeout_sec         = optional(number)<br>      healthy_threshold   = optional(number)<br>      unhealthy_threshold = optional(number)<br>      logging             = optional(bool)<br>    })<br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>      balancing_mode               = optional(string)<br>      capacity_scaler              = optional(number)<br>      description                  = optional(string)<br>      max_connections              = optional(number)<br>      max_connections_per_instance = optional(number)<br>      max_connections_per_endpoint = optional(number)<br>      max_rate                     = optional(number)<br>      max_rate_per_instance        = optional(number)<br>      max_rate_per_endpoint        = optional(number)<br>      max_utilization              = optional(number)<br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>    outlier_detection = optional(object({<br>      base_ejection_time = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      consecutive_errors                    = optional(number)<br>      consecutive_gateway_failure           = optional(number)<br>      enforcing_consecutive_errors          = optional(number)<br>      enforcing_consecutive_gateway_failure = optional(number)<br>      enforcing_success_rate                = optional(number)<br>      interval = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      max_ejection_percent        = optional(number)<br>      success_rate_minimum_hosts  = optional(number)<br>      success_rate_request_volume = optional(number)<br>      success_rate_stdev_factor   = optional(number)<br>    }))<br>  }))</pre> | n/a | yes |
-| certificate | Content of the SSL certificate. Required if `ssl` is `true` and `ssl_certificates` is empty. | `string` | `null` | no |
-| certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy | `string` | `null` | no |
+| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    port                    = optional(number)<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    timeout_sec                     = optional(number)<br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br>    health_check = object({<br>      host                = optional(string)<br>      request_path        = optional(string)<br>      request             = optional(string)<br>      response            = optional(string)<br>      port                = optional(number)<br>      port_name           = optional(string)<br>      proxy_header        = optional(string)<br>      port_specification  = optional(string)<br>      protocol            = optional(string)<br>      check_interval_sec  = optional(number)<br>      timeout_sec         = optional(number)<br>      healthy_threshold   = optional(number)<br>      unhealthy_threshold = optional(number)<br>      logging             = optional(bool)<br>    })<br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>      balancing_mode               = optional(string)<br>      capacity_scaler              = optional(number)<br>      description                  = optional(string)<br>      max_connections              = optional(number)<br>      max_connections_per_instance = optional(number)<br>      max_connections_per_endpoint = optional(number)<br>      max_rate                     = optional(number)<br>      max_rate_per_instance        = optional(number)<br>      max_rate_per_endpoint        = optional(number)<br>      max_utilization              = optional(number)<br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>  }))</pre> | n/a | yes |
+| certificate | Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
+| certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true` | `string` | `null` | no |
 | create\_address | Create a new global IPv4 address | `bool` | `true` | no |
 | create\_ipv6\_address | Allocate a new IPv6 address. Conflicts with "ipv6\_address" - if both specified, "create\_ipv6\_address" takes precedence. | `bool` | `false` | no |
+| create\_ssl\_certificate | If `true`, Create certificate using `private_key/certificate` | `bool` | `false` | no |
 | create\_url\_map | Set to `false` if url\_map variable is provided. | `bool` | `true` | no |
 | edge\_security\_policy | The resource URL for the edge security policy to associate with the backend service | `string` | `null` | no |
 | enable\_ipv6 | Enable IPv6 address on the CDN load-balancer | `bool` | `false` | no |
@@ -128,21 +129,20 @@ module "gce-lb-http" {
 | ipv6\_address | An existing IPv6 address to use (the actual IP address value) | `string` | `null` | no |
 | labels | The labels to attach to resources created by this module | `map(string)` | `{}` | no |
 | load\_balancing\_scheme | Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL\_MANAGED for Envoy-based load balancer, and INTERNAL\_SELF\_MANAGED for traffic director) | `string` | `"EXTERNAL"` | no |
-| managed\_ssl\_certificate\_domains | Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` and `use_ssl_certificates` set to `false`. | `list(string)` | `[]` | no |
+| managed\_ssl\_certificate\_domains | Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` | `list(string)` | `[]` | no |
 | name | Name for the forwarding rule and prefix for supporting resources | `string` | n/a | yes |
 | network | Network for INTERNAL\_SELF\_MANAGED load balancing scheme | `string` | `"default"` | no |
-| private\_key | Content of the private SSL key. Required if `ssl` is `true` and `ssl_certificates` is empty. | `string` | `null` | no |
+| private\_key | Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
 | project | The project to deploy to, if not set the default provider project is used. | `string` | n/a | yes |
 | quic | Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only. | `bool` | `null` | no |
 | random\_certificate\_suffix | Bool to enable/disable random certificate name generation. Set and keep this to true if you need to change the SSL cert. | `bool` | `false` | no |
 | security\_policy | The resource URL for the security policy to associate with the backend service | `string` | `null` | no |
-| ssl | Set to `true` to enable SSL support, requires variable `ssl_certificates` - a list of self\_link certs | `bool` | `false` | no |
-| ssl\_certificates | SSL cert self\_link list. Required if `ssl` is `true` and no `private_key` and `certificate` is provided. | `list(string)` | `[]` | no |
+| ssl | Set to `true` to enable SSL support. If `true` then at least one of these are required: 1) `ssl_certificates` OR 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  3) `managed_ssl_certificate_domains`, OR 4) `certificate_map` | `bool` | `false` | no |
+| ssl\_certificates | SSL cert self\_link list. Requires `ssl` to be set to `true` | `list(string)` | `[]` | no |
 | ssl\_policy | Selfink to SSL Policy | `string` | `null` | no |
 | target\_service\_accounts | List of target service accounts for health check firewall rule. Exactly one of target\_tags or target\_service\_accounts should be specified. | `list(string)` | `[]` | no |
 | target\_tags | List of target tags for health check firewall rule. Exactly one of target\_tags or target\_service\_accounts should be specified. | `list(string)` | `[]` | no |
 | url\_map | The url\_map resource to use. Default is to send all traffic to first backend. | `string` | `null` | no |
-| use\_ssl\_certificates | If true, use the certificates provided by `ssl_certificates`, otherwise, create cert from `private_key` and `certificate` | `bool` | `false` | no |
 
 ## Outputs
 
diff --git a/modules/dynamic_backends/main.tf b/modules/dynamic_backends/main.tf
index d6ff812f..84615e32 100644
--- a/modules/dynamic_backends/main.tf
+++ b/modules/dynamic_backends/main.tf
@@ -45,7 +45,7 @@ resource "google_compute_global_forwarding_rule" "http" {
 resource "google_compute_global_forwarding_rule" "https" {
   provider              = google-beta
   project               = var.project
-  count                 = var.ssl || var.certificate_map != null ? 1 : 0
+  count                 = var.ssl ? 1 : 0
   name                  = "${var.name}-https"
   target                = google_compute_target_https_proxy.default[0].self_link
   ip_address            = local.address
@@ -82,7 +82,7 @@ resource "google_compute_global_forwarding_rule" "http_ipv6" {
 resource "google_compute_global_forwarding_rule" "https_ipv6" {
   provider              = google-beta
   project               = var.project
-  count                 = var.enable_ipv6 && (var.ssl || var.certificate_map != null) ? 1 : 0
+  count                 = var.enable_ipv6 && var.ssl ? 1 : 0
   name                  = "${var.name}-ipv6-https"
   target                = google_compute_target_https_proxy.default[0].self_link
   ip_address            = local.ipv6_address
@@ -113,7 +113,7 @@ resource "google_compute_target_http_proxy" "default" {
 # HTTPS proxy when ssl is true
 resource "google_compute_target_https_proxy" "default" {
   project = var.project
-  count   = var.ssl || var.certificate_map != null ? 1 : 0
+  count   = var.ssl ? 1 : 0
   name    = "${var.name}-https-proxy"
   url_map = local.url_map
 
@@ -125,7 +125,7 @@ resource "google_compute_target_https_proxy" "default" {
 
 resource "google_compute_ssl_certificate" "default" {
   project     = var.project
-  count       = var.ssl && length(var.managed_ssl_certificate_domains) == 0 && !var.use_ssl_certificates ? 1 : 0
+  count       = var.ssl && var.create_ssl_certificate ? 1 : 0
   name_prefix = "${var.name}-certificate-"
   private_key = var.private_key
   certificate = var.certificate
@@ -148,7 +148,7 @@ resource "random_id" "certificate" {
 resource "google_compute_managed_ssl_certificate" "default" {
   provider = google-beta
   project  = var.project
-  count    = var.ssl && length(var.managed_ssl_certificate_domains) > 0 && !var.use_ssl_certificates ? 1 : 0
+  count    = var.ssl && length(var.managed_ssl_certificate_domains) > 0 ? 1 : 0
   name     = var.random_certificate_suffix == true ? random_id.certificate[0].hex : "${var.name}-cert"
 
   lifecycle {
diff --git a/modules/dynamic_backends/variables.tf b/modules/dynamic_backends/variables.tf
index 5f27bff0..56018f1b 100644
--- a/modules/dynamic_backends/variables.tf
+++ b/modules/dynamic_backends/variables.tf
@@ -202,51 +202,57 @@ variable "http_forward" {
 }
 
 variable "ssl" {
-  description = "Set to `true` to enable SSL support, requires variable `ssl_certificates` - a list of self_link certs"
+  description = "Set to `true` to enable SSL support. If `true` then at least one of these are required: 1) `ssl_certificates` OR 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  3) `managed_ssl_certificate_domains`, OR 4) `certificate_map`"
   type        = bool
   default     = false
 }
 
-variable "ssl_policy" {
-  type        = string
-  description = "Selfink to SSL Policy"
-  default     = null
+variable "create_ssl_certificate" {
+  description = "If `true`, Create certificate using `private_key/certificate`"
+  type        = bool
+  default     = false
 }
 
-variable "quic" {
-  type        = bool
-  description = "Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only."
-  default     = null
+variable "ssl_certificates" {
+  description = "SSL cert self_link list. Requires `ssl` to be set to `true`"
+  type        = list(string)
+  default     = []
 }
 
 variable "private_key" {
-  description = "Content of the private SSL key. Required if `ssl` is `true` and `ssl_certificates` is empty."
+  description = "Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`"
   type        = string
   default     = null
 }
 
 variable "certificate" {
-  description = "Content of the SSL certificate. Required if `ssl` is `true` and `ssl_certificates` is empty."
+  description = "Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`"
   type        = string
   default     = null
 }
 
 variable "managed_ssl_certificate_domains" {
-  description = "Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` and `use_ssl_certificates` set to `false`."
+  description = "Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true`"
   type        = list(string)
   default     = []
 }
 
-variable "use_ssl_certificates" {
-  description = "If true, use the certificates provided by `ssl_certificates`, otherwise, create cert from `private_key` and `certificate`"
-  type        = bool
-  default     = false
+variable "certificate_map" {
+  description = "Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true`"
+  type        = string
+  default     = null
 }
 
-variable "ssl_certificates" {
-  description = "SSL cert self_link list. Required if `ssl` is `true` and no `private_key` and `certificate` is provided."
-  type        = list(string)
-  default     = []
+variable "ssl_policy" {
+  type        = string
+  description = "Selfink to SSL Policy"
+  default     = null
+}
+
+variable "quic" {
+  type        = bool
+  description = "Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only."
+  default     = null
 }
 
 variable "edge_security_policy" {
@@ -285,12 +291,6 @@ variable "load_balancing_scheme" {
   default     = "EXTERNAL"
 }
 
-variable "certificate_map" {
-  description = "Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy"
-  type        = string
-  default     = null
-}
-
 variable "network" {
   description = "Network for INTERNAL_SELF_MANAGED load balancing scheme"
   type        = string
diff --git a/modules/serverless_negs/README.md b/modules/serverless_negs/README.md
index 9e1588b7..062aaac6 100644
--- a/modules/serverless_negs/README.md
+++ b/modules/serverless_negs/README.md
@@ -79,11 +79,12 @@ module "lb-http" {
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | address | Existing IPv4 address to use (the actual IP address value) | `string` | `null` | no |
-| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>    outlier_detection = optional(object({<br>      base_ejection_time = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      consecutive_errors                    = optional(number)<br>      consecutive_gateway_failure           = optional(number)<br>      enforcing_consecutive_errors          = optional(number)<br>      enforcing_consecutive_gateway_failure = optional(number)<br>      enforcing_success_rate                = optional(number)<br>      interval = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      max_ejection_percent        = optional(number)<br>      success_rate_minimum_hosts  = optional(number)<br>      success_rate_request_volume = optional(number)<br>      success_rate_stdev_factor   = optional(number)<br>    }))<br>  }))</pre> | n/a | yes |
-| certificate | Content of the SSL certificate. Required if `ssl` is `true` and `ssl_certificates` is empty. | `string` | `null` | no |
-| certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy | `string` | `null` | no |
+| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>  }))</pre> | n/a | yes |
+| certificate | Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
+| certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true` | `string` | `null` | no |
 | create\_address | Create a new global IPv4 address | `bool` | `true` | no |
 | create\_ipv6\_address | Allocate a new IPv6 address. Conflicts with "ipv6\_address" - if both specified, "create\_ipv6\_address" takes precedence. | `bool` | `false` | no |
+| create\_ssl\_certificate | If `true`, Create certificate using `private_key/certificate` | `bool` | `false` | no |
 | create\_url\_map | Set to `false` if url\_map variable is provided. | `bool` | `true` | no |
 | edge\_security\_policy | The resource URL for the edge security policy to associate with the backend service | `string` | `null` | no |
 | enable\_ipv6 | Enable IPv6 address on the CDN load-balancer | `bool` | `false` | no |
@@ -92,19 +93,18 @@ module "lb-http" {
 | ipv6\_address | An existing IPv6 address to use (the actual IP address value) | `string` | `null` | no |
 | labels | The labels to attach to resources created by this module | `map(string)` | `{}` | no |
 | load\_balancing\_scheme | Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL\_MANAGED for Envoy-based load balancer, and INTERNAL\_SELF\_MANAGED for traffic director) | `string` | `"EXTERNAL"` | no |
-| managed\_ssl\_certificate\_domains | Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` and `use_ssl_certificates` set to `false`. | `list(string)` | `[]` | no |
+| managed\_ssl\_certificate\_domains | Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` | `list(string)` | `[]` | no |
 | name | Name for the forwarding rule and prefix for supporting resources | `string` | n/a | yes |
 | network | Network for INTERNAL\_SELF\_MANAGED load balancing scheme | `string` | `"default"` | no |
-| private\_key | Content of the private SSL key. Required if `ssl` is `true` and `ssl_certificates` is empty. | `string` | `null` | no |
+| private\_key | Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
 | project | The project to deploy to, if not set the default provider project is used. | `string` | n/a | yes |
 | quic | Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only. | `bool` | `null` | no |
 | random\_certificate\_suffix | Bool to enable/disable random certificate name generation. Set and keep this to true if you need to change the SSL cert. | `bool` | `false` | no |
 | security\_policy | The resource URL for the security policy to associate with the backend service | `string` | `null` | no |
-| ssl | Set to `true` to enable SSL support, requires variable `ssl_certificates` - a list of self\_link certs | `bool` | `false` | no |
-| ssl\_certificates | SSL cert self\_link list. Required if `ssl` is `true` and no `private_key` and `certificate` is provided. | `list(string)` | `[]` | no |
+| ssl | Set to `true` to enable SSL support. If `true` then at least one of these are required: 1) `ssl_certificates` OR 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  3) `managed_ssl_certificate_domains`, OR 4) `certificate_map` | `bool` | `false` | no |
+| ssl\_certificates | SSL cert self\_link list. Requires `ssl` to be set to `true` | `list(string)` | `[]` | no |
 | ssl\_policy | Selfink to SSL Policy | `string` | `null` | no |
 | url\_map | The url\_map resource to use. Default is to send all traffic to first backend. | `string` | `null` | no |
-| use\_ssl\_certificates | If true, use the certificates provided by `ssl_certificates`, otherwise, create cert from `private_key` and `certificate` | `bool` | `false` | no |
 
 ## Outputs
 
diff --git a/modules/serverless_negs/main.tf b/modules/serverless_negs/main.tf
index 90ed40cc..f7036808 100644
--- a/modules/serverless_negs/main.tf
+++ b/modules/serverless_negs/main.tf
@@ -44,7 +44,7 @@ resource "google_compute_global_forwarding_rule" "http" {
 resource "google_compute_global_forwarding_rule" "https" {
   provider              = google-beta
   project               = var.project
-  count                 = var.ssl || var.certificate_map != null ? 1 : 0
+  count                 = var.ssl ? 1 : 0
   name                  = "${var.name}-https"
   target                = google_compute_target_https_proxy.default[0].self_link
   ip_address            = local.address
@@ -81,7 +81,7 @@ resource "google_compute_global_forwarding_rule" "http_ipv6" {
 resource "google_compute_global_forwarding_rule" "https_ipv6" {
   provider              = google-beta
   project               = var.project
-  count                 = var.enable_ipv6 && (var.ssl || var.certificate_map != null) ? 1 : 0
+  count                 = var.enable_ipv6 && var.ssl ? 1 : 0
   name                  = "${var.name}-ipv6-https"
   target                = google_compute_target_https_proxy.default[0].self_link
   ip_address            = local.ipv6_address
@@ -112,7 +112,7 @@ resource "google_compute_target_http_proxy" "default" {
 # HTTPS proxy when ssl is true
 resource "google_compute_target_https_proxy" "default" {
   project = var.project
-  count   = var.ssl || var.certificate_map != null ? 1 : 0
+  count   = var.ssl ? 1 : 0
   name    = "${var.name}-https-proxy"
   url_map = local.url_map
 
@@ -124,7 +124,7 @@ resource "google_compute_target_https_proxy" "default" {
 
 resource "google_compute_ssl_certificate" "default" {
   project     = var.project
-  count       = var.ssl && length(var.managed_ssl_certificate_domains) == 0 && !var.use_ssl_certificates ? 1 : 0
+  count       = var.ssl && var.create_ssl_certificate ? 1 : 0
   name_prefix = "${var.name}-certificate-"
   private_key = var.private_key
   certificate = var.certificate
@@ -147,7 +147,7 @@ resource "random_id" "certificate" {
 resource "google_compute_managed_ssl_certificate" "default" {
   provider = google-beta
   project  = var.project
-  count    = var.ssl && length(var.managed_ssl_certificate_domains) > 0 && !var.use_ssl_certificates ? 1 : 0
+  count    = var.ssl && length(var.managed_ssl_certificate_domains) > 0 ? 1 : 0
   name     = var.random_certificate_suffix == true ? random_id.certificate[0].hex : "${var.name}-cert"
 
   lifecycle {
diff --git a/modules/serverless_negs/variables.tf b/modules/serverless_negs/variables.tf
index 1629d1a2..59a56b3e 100644
--- a/modules/serverless_negs/variables.tf
+++ b/modules/serverless_negs/variables.tf
@@ -151,51 +151,57 @@ variable "http_forward" {
 }
 
 variable "ssl" {
-  description = "Set to `true` to enable SSL support, requires variable `ssl_certificates` - a list of self_link certs"
+  description = "Set to `true` to enable SSL support. If `true` then at least one of these are required: 1) `ssl_certificates` OR 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  3) `managed_ssl_certificate_domains`, OR 4) `certificate_map`"
   type        = bool
   default     = false
 }
 
-variable "ssl_policy" {
-  type        = string
-  description = "Selfink to SSL Policy"
-  default     = null
+variable "create_ssl_certificate" {
+  description = "If `true`, Create certificate using `private_key/certificate`"
+  type        = bool
+  default     = false
 }
 
-variable "quic" {
-  type        = bool
-  description = "Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only."
-  default     = null
+variable "ssl_certificates" {
+  description = "SSL cert self_link list. Requires `ssl` to be set to `true`"
+  type        = list(string)
+  default     = []
 }
 
 variable "private_key" {
-  description = "Content of the private SSL key. Required if `ssl` is `true` and `ssl_certificates` is empty."
+  description = "Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`"
   type        = string
   default     = null
 }
 
 variable "certificate" {
-  description = "Content of the SSL certificate. Required if `ssl` is `true` and `ssl_certificates` is empty."
+  description = "Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`"
   type        = string
   default     = null
 }
 
 variable "managed_ssl_certificate_domains" {
-  description = "Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` and `use_ssl_certificates` set to `false`."
+  description = "Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true`"
   type        = list(string)
   default     = []
 }
 
-variable "use_ssl_certificates" {
-  description = "If true, use the certificates provided by `ssl_certificates`, otherwise, create cert from `private_key` and `certificate`"
-  type        = bool
-  default     = false
+variable "certificate_map" {
+  description = "Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true`"
+  type        = string
+  default     = null
 }
 
-variable "ssl_certificates" {
-  description = "SSL cert self_link list. Required if `ssl` is `true` and no `private_key` and `certificate` is provided."
-  type        = list(string)
-  default     = []
+variable "ssl_policy" {
+  type        = string
+  description = "Selfink to SSL Policy"
+  default     = null
+}
+
+variable "quic" {
+  type        = bool
+  description = "Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only."
+  default     = null
 }
 
 variable "edge_security_policy" {
@@ -234,12 +240,6 @@ variable "load_balancing_scheme" {
   default     = "EXTERNAL"
 }
 
-variable "certificate_map" {
-  description = "Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy"
-  type        = string
-  default     = null
-}
-
 variable "network" {
   description = "Network for INTERNAL_SELF_MANAGED load balancing scheme"
   type        = string
diff --git a/test/setup/main.tf b/test/setup/main.tf
index c94f1ce7..e011f519 100644
--- a/test/setup/main.tf
+++ b/test/setup/main.tf
@@ -34,6 +34,7 @@ module "project-ci-lb-http" {
     "compute.googleapis.com",
     "run.googleapis.com",
     "iam.googleapis.com",
+    "certificatemanager.googleapis.com",
   ]
 }
 
@@ -57,5 +58,6 @@ module "project-ci-lb-http-1" {
     "compute.googleapis.com",
     "run.googleapis.com",
     "iam.googleapis.com",
+    "certificatemanager.googleapis.com",
   ]
 }
diff --git a/variables.tf b/variables.tf
index 5f27bff0..56018f1b 100644
--- a/variables.tf
+++ b/variables.tf
@@ -202,51 +202,57 @@ variable "http_forward" {
 }
 
 variable "ssl" {
-  description = "Set to `true` to enable SSL support, requires variable `ssl_certificates` - a list of self_link certs"
+  description = "Set to `true` to enable SSL support. If `true` then at least one of these are required: 1) `ssl_certificates` OR 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  3) `managed_ssl_certificate_domains`, OR 4) `certificate_map`"
   type        = bool
   default     = false
 }
 
-variable "ssl_policy" {
-  type        = string
-  description = "Selfink to SSL Policy"
-  default     = null
+variable "create_ssl_certificate" {
+  description = "If `true`, Create certificate using `private_key/certificate`"
+  type        = bool
+  default     = false
 }
 
-variable "quic" {
-  type        = bool
-  description = "Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only."
-  default     = null
+variable "ssl_certificates" {
+  description = "SSL cert self_link list. Requires `ssl` to be set to `true`"
+  type        = list(string)
+  default     = []
 }
 
 variable "private_key" {
-  description = "Content of the private SSL key. Required if `ssl` is `true` and `ssl_certificates` is empty."
+  description = "Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`"
   type        = string
   default     = null
 }
 
 variable "certificate" {
-  description = "Content of the SSL certificate. Required if `ssl` is `true` and `ssl_certificates` is empty."
+  description = "Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`"
   type        = string
   default     = null
 }
 
 variable "managed_ssl_certificate_domains" {
-  description = "Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` and `use_ssl_certificates` set to `false`."
+  description = "Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true`"
   type        = list(string)
   default     = []
 }
 
-variable "use_ssl_certificates" {
-  description = "If true, use the certificates provided by `ssl_certificates`, otherwise, create cert from `private_key` and `certificate`"
-  type        = bool
-  default     = false
+variable "certificate_map" {
+  description = "Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true`"
+  type        = string
+  default     = null
 }
 
-variable "ssl_certificates" {
-  description = "SSL cert self_link list. Required if `ssl` is `true` and no `private_key` and `certificate` is provided."
-  type        = list(string)
-  default     = []
+variable "ssl_policy" {
+  type        = string
+  description = "Selfink to SSL Policy"
+  default     = null
+}
+
+variable "quic" {
+  type        = bool
+  description = "Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only."
+  default     = null
 }
 
 variable "edge_security_policy" {
@@ -285,12 +291,6 @@ variable "load_balancing_scheme" {
   default     = "EXTERNAL"
 }
 
-variable "certificate_map" {
-  description = "Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy"
-  type        = string
-  default     = null
-}
-
 variable "network" {
   description = "Network for INTERNAL_SELF_MANAGED load balancing scheme"
   type        = string

From 3dfc6f308fdb29a7279c2c99d41cfaee085fb48a Mon Sep 17 00:00:00 2001
From: Imran Nayer <imrannayer@google.com>
Date: Mon, 6 Nov 2023 19:49:49 +0000
Subject: [PATCH 2/7] fix certificate-map

---
 README.md                           |  3 ++-
 autogen/outputs.tf.tmpl             |  8 ++++----
 build/int.cloudbuild.yaml           | 26 ++++++++++++++++++++++++++
 examples/dynamic-backend/main.tf    |  3 +--
 examples/https-redirect/main.tf     | 17 ++++++++---------
 examples/multiple-certs/main.tf     | 11 +++++------
 modules/dynamic_backends/README.md  |  3 ++-
 modules/dynamic_backends/outputs.tf |  5 +++++
 modules/serverless_negs/README.md   |  3 ++-
 modules/serverless_negs/outputs.tf  |  5 +++++
 outputs.tf                          |  5 +++++
 11 files changed, 65 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index 90df9227..529b025e 100644
--- a/README.md
+++ b/README.md
@@ -120,7 +120,7 @@ module "gce-lb-http" {
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | address | Existing IPv4 address to use (the actual IP address value) | `string` | `null` | no |
-| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    port                    = optional(number)<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    timeout_sec                     = optional(number)<br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br>    health_check = object({<br>      host                = optional(string)<br>      request_path        = optional(string)<br>      request             = optional(string)<br>      response            = optional(string)<br>      port                = optional(number)<br>      port_name           = optional(string)<br>      proxy_header        = optional(string)<br>      port_specification  = optional(string)<br>      protocol            = optional(string)<br>      check_interval_sec  = optional(number)<br>      timeout_sec         = optional(number)<br>      healthy_threshold   = optional(number)<br>      unhealthy_threshold = optional(number)<br>      logging             = optional(bool)<br>    })<br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>      balancing_mode               = optional(string)<br>      capacity_scaler              = optional(number)<br>      description                  = optional(string)<br>      max_connections              = optional(number)<br>      max_connections_per_instance = optional(number)<br>      max_connections_per_endpoint = optional(number)<br>      max_rate                     = optional(number)<br>      max_rate_per_instance        = optional(number)<br>      max_rate_per_endpoint        = optional(number)<br>      max_utilization              = optional(number)<br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>  }))</pre> | n/a | yes |
+| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    port                    = optional(number)<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    timeout_sec                     = optional(number)<br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br>    health_check = object({<br>      host                = optional(string)<br>      request_path        = optional(string)<br>      request             = optional(string)<br>      response            = optional(string)<br>      port                = optional(number)<br>      port_name           = optional(string)<br>      proxy_header        = optional(string)<br>      port_specification  = optional(string)<br>      protocol            = optional(string)<br>      check_interval_sec  = optional(number)<br>      timeout_sec         = optional(number)<br>      healthy_threshold   = optional(number)<br>      unhealthy_threshold = optional(number)<br>      logging             = optional(bool)<br>    })<br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>      balancing_mode               = optional(string)<br>      capacity_scaler              = optional(number)<br>      description                  = optional(string)<br>      max_connections              = optional(number)<br>      max_connections_per_instance = optional(number)<br>      max_connections_per_endpoint = optional(number)<br>      max_rate                     = optional(number)<br>      max_rate_per_instance        = optional(number)<br>      max_rate_per_endpoint        = optional(number)<br>      max_utilization              = optional(number)<br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>    outlier_detection = optional(object({<br>      base_ejection_time = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      consecutive_errors                    = optional(number)<br>      consecutive_gateway_failure           = optional(number)<br>      enforcing_consecutive_errors          = optional(number)<br>      enforcing_consecutive_gateway_failure = optional(number)<br>      enforcing_success_rate                = optional(number)<br>      interval = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      max_ejection_percent        = optional(number)<br>      success_rate_minimum_hosts  = optional(number)<br>      success_rate_request_volume = optional(number)<br>      success_rate_stdev_factor   = optional(number)<br>    }))<br>  }))</pre> | n/a | yes |
 | certificate | Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
 | certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true` | `string` | `null` | no |
 | create\_address | Create a new global IPv4 address | `bool` | `true` | no |
@@ -161,6 +161,7 @@ module "gce-lb-http" {
 | http\_proxy | The HTTP proxy used by this module. |
 | https\_proxy | The HTTPS proxy used by this module. |
 | ipv6\_enabled | Whether IPv6 configuration is enabled on this load-balancer |
+| ssl\_certificate\_created | The SSL certificate create from key/pem |
 | url\_map | The default URL map used by this module. |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/autogen/outputs.tf.tmpl b/autogen/outputs.tf.tmpl
index 7e7a8afa..8cbc4e2d 100644
--- a/autogen/outputs.tf.tmpl
+++ b/autogen/outputs.tf.tmpl
@@ -50,7 +50,7 @@ output "url_map" {
   value       = google_compute_url_map.default[*].self_link
 }
 
-output  "ssl_certificate" {
-  description = "The managed SSL certificates"
-  value       = google_compute_ssl_certificate.default.self_link
-}
\ No newline at end of file
+output  "ssl_certificate_created" {
+  description = "The SSL certificate create from key/pem"
+  value       = google_compute_ssl_certificate.default.*.self_link
+}
diff --git a/build/int.cloudbuild.yaml b/build/int.cloudbuild.yaml
index fd28d8d8..4054a752 100644
--- a/build/int.cloudbuild.yaml
+++ b/build/int.cloudbuild.yaml
@@ -62,6 +62,32 @@ steps:
 - id: traffic-director-example-teardown
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'cft test run TestAll/examples/traffic-director --stage teardown --verbose']
+# certificate-map example
+- id: certificate-map-example-init
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TTestAll/examples/certificate-map --stage init --verbose']
+- id: certificate-map-example-apply
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TTestAll/examples/certificate-map --stage apply --verbose']
+- id: certificate-map-example-verify
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TTestAll/examples/certificate-map --stage verify --verbose']
+- id: certificate-map-example-teardown
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TTestAll/examples/certificate-map --stage teardown --verbose']
+# managed-manual-certificates example
+- id: user-managed-google-managed-ssl-example-init
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestAll/examples/user-managed-google-managed-ssl --stage init --verbose']
+- id: user-managed-google-managed-ssl-example-apply
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestAll/examples/user-managed-google-managed-ssl --stage apply --verbose']
+- id: user-managed-google-managed-ssl-example-verify
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestAll/examples/user-managed-google-managed-ssl --stage verify --verbose']
+- id: user-managed-google-managed-ssl-example-teardown
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestAll/examples/user-managed-google-managed-ssl --stage teardown --verbose']
 tags:
 - 'ci'
 - 'integration'
diff --git a/examples/dynamic-backend/main.tf b/examples/dynamic-backend/main.tf
index 101cceed..2d1bfea7 100644
--- a/examples/dynamic-backend/main.tf
+++ b/examples/dynamic-backend/main.tf
@@ -41,8 +41,7 @@ module "load_balancer" {
 
   load_balancing_scheme = "EXTERNAL_MANAGED"
 
-  ssl                  = true
-  use_ssl_certificates = true
+  ssl = true
   ssl_certificates = [
     google_compute_managed_ssl_certificate.frontend.self_link
   ]
diff --git a/examples/https-redirect/main.tf b/examples/https-redirect/main.tf
index 5929e3f0..073db8ae 100644
--- a/examples/https-redirect/main.tf
+++ b/examples/https-redirect/main.tf
@@ -92,15 +92,14 @@ module "mig" {
 
 # [START cloudloadbalancing_ext_http_gce_http_redirect]
 module "gce-lb-http" {
-  source               = "../../"
-  name                 = "ci-https-redirect"
-  project              = var.project
-  target_tags          = [var.network_name]
-  firewall_networks    = [google_compute_network.default.name]
-  ssl                  = true
-  ssl_certificates     = [google_compute_ssl_certificate.example.self_link]
-  use_ssl_certificates = true
-  https_redirect       = true
+  source            = "../../"
+  name              = "ci-https-redirect"
+  project           = var.project
+  target_tags       = [var.network_name]
+  firewall_networks = [google_compute_network.default.name]
+  ssl               = true
+  ssl_certificates  = [google_compute_ssl_certificate.example.self_link]
+  https_redirect    = true
 
   backends = {
     default = {
diff --git a/examples/multiple-certs/main.tf b/examples/multiple-certs/main.tf
index 1735aab0..9d9d9f04 100644
--- a/examples/multiple-certs/main.tf
+++ b/examples/multiple-certs/main.tf
@@ -129,12 +129,11 @@ module "gce-lb-https" {
     "${var.network_name}-group3",
     module.cloud-nat-group3.router_name
   ]
-  firewall_networks    = [google_compute_network.default.self_link]
-  url_map              = google_compute_url_map.https-multi-cert.self_link
-  create_url_map       = false
-  ssl                  = true
-  ssl_certificates     = google_compute_ssl_certificate.example.*.self_link
-  use_ssl_certificates = true
+  firewall_networks = [google_compute_network.default.self_link]
+  url_map           = google_compute_url_map.https-multi-cert.self_link
+  create_url_map    = false
+  ssl               = true
+  ssl_certificates  = google_compute_ssl_certificate.example.*.self_link
 
   backends = {
     default = {
diff --git a/modules/dynamic_backends/README.md b/modules/dynamic_backends/README.md
index a10c39db..6f6f4219 100644
--- a/modules/dynamic_backends/README.md
+++ b/modules/dynamic_backends/README.md
@@ -113,7 +113,7 @@ module "gce-lb-http" {
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | address | Existing IPv4 address to use (the actual IP address value) | `string` | `null` | no |
-| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    port                    = optional(number)<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    timeout_sec                     = optional(number)<br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br>    health_check = object({<br>      host                = optional(string)<br>      request_path        = optional(string)<br>      request             = optional(string)<br>      response            = optional(string)<br>      port                = optional(number)<br>      port_name           = optional(string)<br>      proxy_header        = optional(string)<br>      port_specification  = optional(string)<br>      protocol            = optional(string)<br>      check_interval_sec  = optional(number)<br>      timeout_sec         = optional(number)<br>      healthy_threshold   = optional(number)<br>      unhealthy_threshold = optional(number)<br>      logging             = optional(bool)<br>    })<br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>      balancing_mode               = optional(string)<br>      capacity_scaler              = optional(number)<br>      description                  = optional(string)<br>      max_connections              = optional(number)<br>      max_connections_per_instance = optional(number)<br>      max_connections_per_endpoint = optional(number)<br>      max_rate                     = optional(number)<br>      max_rate_per_instance        = optional(number)<br>      max_rate_per_endpoint        = optional(number)<br>      max_utilization              = optional(number)<br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>  }))</pre> | n/a | yes |
+| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    port                    = optional(number)<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    timeout_sec                     = optional(number)<br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br>    health_check = object({<br>      host                = optional(string)<br>      request_path        = optional(string)<br>      request             = optional(string)<br>      response            = optional(string)<br>      port                = optional(number)<br>      port_name           = optional(string)<br>      proxy_header        = optional(string)<br>      port_specification  = optional(string)<br>      protocol            = optional(string)<br>      check_interval_sec  = optional(number)<br>      timeout_sec         = optional(number)<br>      healthy_threshold   = optional(number)<br>      unhealthy_threshold = optional(number)<br>      logging             = optional(bool)<br>    })<br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>      balancing_mode               = optional(string)<br>      capacity_scaler              = optional(number)<br>      description                  = optional(string)<br>      max_connections              = optional(number)<br>      max_connections_per_instance = optional(number)<br>      max_connections_per_endpoint = optional(number)<br>      max_rate                     = optional(number)<br>      max_rate_per_instance        = optional(number)<br>      max_rate_per_endpoint        = optional(number)<br>      max_utilization              = optional(number)<br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>    outlier_detection = optional(object({<br>      base_ejection_time = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      consecutive_errors                    = optional(number)<br>      consecutive_gateway_failure           = optional(number)<br>      enforcing_consecutive_errors          = optional(number)<br>      enforcing_consecutive_gateway_failure = optional(number)<br>      enforcing_success_rate                = optional(number)<br>      interval = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      max_ejection_percent        = optional(number)<br>      success_rate_minimum_hosts  = optional(number)<br>      success_rate_request_volume = optional(number)<br>      success_rate_stdev_factor   = optional(number)<br>    }))<br>  }))</pre> | n/a | yes |
 | certificate | Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
 | certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true` | `string` | `null` | no |
 | create\_address | Create a new global IPv4 address | `bool` | `true` | no |
@@ -154,6 +154,7 @@ module "gce-lb-http" {
 | http\_proxy | The HTTP proxy used by this module. |
 | https\_proxy | The HTTPS proxy used by this module. |
 | ipv6\_enabled | Whether IPv6 configuration is enabled on this load-balancer |
+| ssl\_certificate\_created | The SSL certificate create from key/pem |
 | url\_map | The default URL map used by this module. |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/dynamic_backends/outputs.tf b/modules/dynamic_backends/outputs.tf
index c17a0ef4..f6d9da29 100644
--- a/modules/dynamic_backends/outputs.tf
+++ b/modules/dynamic_backends/outputs.tf
@@ -49,3 +49,8 @@ output "url_map" {
   description = "The default URL map used by this module."
   value       = google_compute_url_map.default[*].self_link
 }
+
+output "ssl_certificate_created" {
+  description = "The SSL certificate create from key/pem"
+  value       = google_compute_ssl_certificate.default.*.self_link
+}
diff --git a/modules/serverless_negs/README.md b/modules/serverless_negs/README.md
index 062aaac6..f40a9551 100644
--- a/modules/serverless_negs/README.md
+++ b/modules/serverless_negs/README.md
@@ -79,7 +79,7 @@ module "lb-http" {
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | address | Existing IPv4 address to use (the actual IP address value) | `string` | `null` | no |
-| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>  }))</pre> | n/a | yes |
+| backends | Map backend indices to list of backend maps. | <pre>map(object({<br>    project                 = optional(string)<br>    protocol                = optional(string)<br>    port_name               = optional(string)<br>    description             = optional(string)<br>    enable_cdn              = optional(bool)<br>    compression_mode        = optional(string)<br>    security_policy         = optional(string, null)<br>    edge_security_policy    = optional(string, null)<br>    custom_request_headers  = optional(list(string))<br>    custom_response_headers = optional(list(string))<br><br>    connection_draining_timeout_sec = optional(number)<br>    session_affinity                = optional(string)<br>    affinity_cookie_ttl_sec         = optional(number)<br><br><br>    log_config = object({<br>      enable      = optional(bool)<br>      sample_rate = optional(number)<br>    })<br><br>    groups = list(object({<br>      group = string<br><br>    }))<br>    iap_config = object({<br>      enable               = bool<br>      oauth2_client_id     = optional(string)<br>      oauth2_client_secret = optional(string)<br>    })<br>    cdn_policy = optional(object({<br>      cache_mode                   = optional(string)<br>      signed_url_cache_max_age_sec = optional(string)<br>      default_ttl                  = optional(number)<br>      max_ttl                      = optional(number)<br>      client_ttl                   = optional(number)<br>      negative_caching             = optional(bool)<br>      negative_caching_policy = optional(object({<br>        code = optional(number)<br>        ttl  = optional(number)<br>      }))<br>      serve_while_stale = optional(number)<br>      cache_key_policy = optional(object({<br>        include_host           = optional(bool)<br>        include_protocol       = optional(bool)<br>        include_query_string   = optional(bool)<br>        query_string_blacklist = optional(list(string))<br>        query_string_whitelist = optional(list(string))<br>        include_http_headers   = optional(list(string))<br>        include_named_cookies  = optional(list(string))<br>      }))<br>    }))<br>    outlier_detection = optional(object({<br>      base_ejection_time = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      consecutive_errors                    = optional(number)<br>      consecutive_gateway_failure           = optional(number)<br>      enforcing_consecutive_errors          = optional(number)<br>      enforcing_consecutive_gateway_failure = optional(number)<br>      enforcing_success_rate                = optional(number)<br>      interval = optional(object({<br>        seconds = number<br>        nanos   = optional(number)<br>      }))<br>      max_ejection_percent        = optional(number)<br>      success_rate_minimum_hosts  = optional(number)<br>      success_rate_request_volume = optional(number)<br>      success_rate_stdev_factor   = optional(number)<br>    }))<br>  }))</pre> | n/a | yes |
 | certificate | Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
 | certificate\_map | Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true` | `string` | `null` | no |
 | create\_address | Create a new global IPv4 address | `bool` | `true` | no |
@@ -116,6 +116,7 @@ module "lb-http" {
 | http\_proxy | The HTTP proxy used by this module. |
 | https\_proxy | The HTTPS proxy used by this module. |
 | ipv6\_enabled | Whether IPv6 configuration is enabled on this load-balancer |
+| ssl\_certificate\_created | The SSL certificate create from key/pem |
 | url\_map | The default URL map used by this module. |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/serverless_negs/outputs.tf b/modules/serverless_negs/outputs.tf
index c17a0ef4..f6d9da29 100644
--- a/modules/serverless_negs/outputs.tf
+++ b/modules/serverless_negs/outputs.tf
@@ -49,3 +49,8 @@ output "url_map" {
   description = "The default URL map used by this module."
   value       = google_compute_url_map.default[*].self_link
 }
+
+output "ssl_certificate_created" {
+  description = "The SSL certificate create from key/pem"
+  value       = google_compute_ssl_certificate.default.*.self_link
+}
diff --git a/outputs.tf b/outputs.tf
index c17a0ef4..f6d9da29 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -49,3 +49,8 @@ output "url_map" {
   description = "The default URL map used by this module."
   value       = google_compute_url_map.default[*].self_link
 }
+
+output "ssl_certificate_created" {
+  description = "The SSL certificate create from key/pem"
+  value       = google_compute_ssl_certificate.default.*.self_link
+}

From bad379e816f6fcfb8621d1d23e99d3e6323da502 Mon Sep 17 00:00:00 2001
From: Imran Nayer <imrannayer@google.com>
Date: Mon, 6 Nov 2023 22:00:23 +0000
Subject: [PATCH 3/7] fix certificate map

---
 README.md                          |  2 +-
 autogen/README.md                  |  2 +-
 docs/upgrading_to_v10.0.md         | 20 ++++++++++++++++++++
 modules/dynamic_backends/README.md |  2 +-
 modules/serverless_negs/README.md  |  2 +-
 5 files changed, 24 insertions(+), 4 deletions(-)
 create mode 100644 docs/upgrading_to_v10.0.md

diff --git a/README.md b/README.md
index 529b025e..8aac0f26 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,7 @@ Current version is 9.0. Upgrade guides:
 - [6.X -> 7.0](/docs/upgrading_to_v7.0.md)
 - [7.X -> 8.0](/docs/upgrading_to_v8.0.md)
 - [8.X -> 9.0](/docs/upgrading_to_v9.0.md)
-
+- [9.X -> 10.0](/docs/upgrading_to_v10.0.m)
 
 ## Usage
 
diff --git a/autogen/README.md b/autogen/README.md
index 08217367..ec5cc46e 100644
--- a/autogen/README.md
+++ b/autogen/README.md
@@ -50,7 +50,7 @@ Current version is 9.0. Upgrade guides:
 - [6.X -> 7.0](/docs/upgrading_to_v7.0.md)
 - [7.X -> 8.0](/docs/upgrading_to_v8.0.md)
 - [8.X -> 9.0](/docs/upgrading_to_v9.0.md)
-
+- [9.X -> 10.0](/docs/upgrading_to_v10.0.m)
 
 ## Usage
 
diff --git a/docs/upgrading_to_v10.0.md b/docs/upgrading_to_v10.0.md
new file mode 100644
index 00000000..1e414f3a
--- /dev/null
+++ b/docs/upgrading_to_v10.0.md
@@ -0,0 +1,20 @@
+# Upgrading to v10.0
+
+The 10.0 release contains backwards-incompatible changes.
+
+---
+
+The `use_ssl_certificates` parameter has been removed. A new parmater `create_ssl_certificate` has been added. 
+
+In order to create https load balancer you need to pass `ssl = true` and one of the following:
+
+1) list of self links to your own certificates passed to`ssl_certificates` OR 
+2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  
+3) list of domains for `managed_ssl_certificate_domains`, OR 
+4) Managed certificate using certificate manager by passing `certificate_map`
+
+Load balancer allows Either 1,2,3 or option 4
+
+---
+See example [user-managed-google-managed-ssl](/examples/user-managed-google-managed-ssl) for combination of `option 1,2,3` where root module will pass self link to certificates, private key/Pem and domain for google managed certificates
+See example [certificate-map](/examples/certificate-map) for `option 4` where root module will pass certificate map
\ No newline at end of file
diff --git a/modules/dynamic_backends/README.md b/modules/dynamic_backends/README.md
index 6f6f4219..892a3d1c 100644
--- a/modules/dynamic_backends/README.md
+++ b/modules/dynamic_backends/README.md
@@ -27,7 +27,7 @@ Current version is 9.0. Upgrade guides:
 - [6.X -> 7.0](/docs/upgrading_to_v7.0.md)
 - [7.X -> 8.0](/docs/upgrading_to_v8.0.md)
 - [8.X -> 9.0](/docs/upgrading_to_v9.0.md)
-
+- [9.X -> 10.0](/docs/upgrading_to_v10.0.m)
 
 ## Usage
 
diff --git a/modules/serverless_negs/README.md b/modules/serverless_negs/README.md
index f40a9551..5999a26d 100644
--- a/modules/serverless_negs/README.md
+++ b/modules/serverless_negs/README.md
@@ -22,7 +22,7 @@ Current version is 9.0. Upgrade guides:
 - [6.X -> 7.0](/docs/upgrading_to_v7.0.md)
 - [7.X -> 8.0](/docs/upgrading_to_v8.0.md)
 - [8.X -> 9.0](/docs/upgrading_to_v9.0.md)
-
+- [9.X -> 10.0](/docs/upgrading_to_v10.0.m)
 
 ## Usage
 

From 8f850089fd00ca87eee50402d47d4bb49fd686b0 Mon Sep 17 00:00:00 2001
From: Imran Nayer <imrannayer@google.com>
Date: Mon, 6 Nov 2023 22:12:13 +0000
Subject: [PATCH 4/7] fix lint

---
 docs/upgrading_to_v10.0.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/upgrading_to_v10.0.md b/docs/upgrading_to_v10.0.md
index 1e414f3a..a95019a4 100644
--- a/docs/upgrading_to_v10.0.md
+++ b/docs/upgrading_to_v10.0.md
@@ -4,17 +4,17 @@ The 10.0 release contains backwards-incompatible changes.
 
 ---
 
-The `use_ssl_certificates` parameter has been removed. A new parmater `create_ssl_certificate` has been added. 
+The `use_ssl_certificates` parameter has been removed. A new parmater `create_ssl_certificate` has been added.
 
 In order to create https load balancer you need to pass `ssl = true` and one of the following:
 
-1) list of self links to your own certificates passed to`ssl_certificates` OR 
-2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  
-3) list of domains for `managed_ssl_certificate_domains`, OR 
+1) list of self links to your own certificates passed to`ssl_certificates` OR
+2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR
+3) list of domains for `managed_ssl_certificate_domains`, OR
 4) Managed certificate using certificate manager by passing `certificate_map`
 
 Load balancer allows Either 1,2,3 or option 4
 
 ---
 See example [user-managed-google-managed-ssl](/examples/user-managed-google-managed-ssl) for combination of `option 1,2,3` where root module will pass self link to certificates, private key/Pem and domain for google managed certificates
-See example [certificate-map](/examples/certificate-map) for `option 4` where root module will pass certificate map
\ No newline at end of file
+See example [certificate-map](/examples/certificate-map) for `option 4` where root module will pass certificate map

From 212411804d2c5ce3a125fb4f8823ddc5c3891b04 Mon Sep 17 00:00:00 2001
From: Imran Nayer <imrannayer@google.com>
Date: Mon, 6 Nov 2023 23:32:10 +0000
Subject: [PATCH 5/7] updated integration test timeout

---
 build/int.cloudbuild.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build/int.cloudbuild.yaml b/build/int.cloudbuild.yaml
index 4054a752..3e6797d7 100644
--- a/build/int.cloudbuild.yaml
+++ b/build/int.cloudbuild.yaml
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-timeout: 4200s
+timeout: 5400s
 steps:
 - id: swap-module-refs
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'

From 12dda6a5f9a755d2b8b87671ec59cb4e98e64733 Mon Sep 17 00:00:00 2001
From: Imran Nayer <imrannayer@google.com>
Date: Tue, 7 Nov 2023 14:57:39 +0000
Subject: [PATCH 6/7] fixed typo

---
 build/int.cloudbuild.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/build/int.cloudbuild.yaml b/build/int.cloudbuild.yaml
index 3e6797d7..ecada0c0 100644
--- a/build/int.cloudbuild.yaml
+++ b/build/int.cloudbuild.yaml
@@ -65,16 +65,16 @@ steps:
 # certificate-map example
 - id: certificate-map-example-init
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'cft test run TTestAll/examples/certificate-map --stage init --verbose']
+  args: ['/bin/bash', '-c', 'cft test run TestAll/examples/certificate-map --stage init --verbose']
 - id: certificate-map-example-apply
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'cft test run TTestAll/examples/certificate-map --stage apply --verbose']
+  args: ['/bin/bash', '-c', 'cft test run TestAll/examples/certificate-map --stage apply --verbose']
 - id: certificate-map-example-verify
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'cft test run TTestAll/examples/certificate-map --stage verify --verbose']
+  args: ['/bin/bash', '-c', 'cft test run TestAll/examples/certificate-map --stage verify --verbose']
 - id: certificate-map-example-teardown
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'cft test run TTestAll/examples/certificate-map --stage teardown --verbose']
+  args: ['/bin/bash', '-c', 'cft test run TestAll/examples/certificate-map --stage teardown --verbose']
 # managed-manual-certificates example
 - id: user-managed-google-managed-ssl-example-init
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'

From f258141739086931cc44e613a1064f70b5218b6c Mon Sep 17 00:00:00 2001
From: Imran Nayer <imrannayer@google.com>
Date: Wed, 8 Nov 2023 15:25:09 +0000
Subject: [PATCH 7/7] fixed lint

---
 docs/upgrading_to_v10.0.md | 55 +++++++++++++++++++++++++++++++++++---
 1 file changed, 52 insertions(+), 3 deletions(-)

diff --git a/docs/upgrading_to_v10.0.md b/docs/upgrading_to_v10.0.md
index a95019a4..0eb5f8a2 100644
--- a/docs/upgrading_to_v10.0.md
+++ b/docs/upgrading_to_v10.0.md
@@ -4,9 +4,11 @@ The 10.0 release contains backwards-incompatible changes.
 
 ---
 
-The `use_ssl_certificates` parameter has been removed. A new parmater `create_ssl_certificate` has been added.
+### use_ssl_certificates is replaced with create_ssl_certificate
 
-In order to create https load balancer you need to pass `ssl = true` and one of the following:
+The `use_ssl_certificates` parameter has been removed. A new parameter `create_ssl_certificate` has been added. You can now create a load balancer with multiple certificates using certificate manager map or certificates (self managed, google managed)
+
+In order to create https load balancer you need to pass `ssl = true` and at least one of the following:
 
 1) list of self links to your own certificates passed to`ssl_certificates` OR
 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR
@@ -16,5 +18,52 @@ In order to create https load balancer you need to pass `ssl = true` and one of
 Load balancer allows Either 1,2,3 or option 4
 
 ---
-See example [user-managed-google-managed-ssl](/examples/user-managed-google-managed-ssl) for combination of `option 1,2,3` where root module will pass self link to certificates, private key/Pem and domain for google managed certificates
+See example [user-managed-google-managed-ssl](/examples/user-managed-google-managed-ssl) for combination of `option 1,2,3` where root module will pass self link to certificates, private key/Pem and domain for google managed certificates. You can now attach google managed certificates and user managed certificates to the load balancer at the same time.
+
+
+```diff
+module "gce-lb-https" {
+-  source            = "GoogleCloudPlatform/lb-http/google"
+-  version           = "~> 9.0"
++  source            = "GoogleCloudPlatform/lb-http/google"
++  version           = "~> 10.0"
+-  use_ssl_certificates            = false
++  create_ssl_certificate          = true
+  ssl                             = true
+  private_key                     = tls_private_key.single_key.private_key_pem
+  certificate                     = tls_self_signed_cert.single_cert.cert_pem
+  managed_ssl_certificate_domains = ["test.example.com"]
+  ssl_certificates                = google_compute_ssl_certificate.example.*.self_link
+```
+
+Here is an example of how to pass list of self managed certificates and domain for google managed certificates. Leave pem/certificate parameter empty
+
+
+```diff
+module "gce-lb-https" {
+-  source            = "GoogleCloudPlatform/lb-http/google"
+-  version           = "~> 9.0"
++  source            = "GoogleCloudPlatform/lb-http/google"
++  version           = "~> 10.0"
+-  use_ssl_certificates            = false
++  create_ssl_certificate          = false
+  ssl                             = true
+  managed_ssl_certificate_domains = ["test.example.com"]
+  ssl_certificates                = google_compute_ssl_certificate.example.*.self_link
+```
+
+---
+
 See example [certificate-map](/examples/certificate-map) for `option 4` where root module will pass certificate map
+
+```diff
+module "gce-lb-https" {
+-  source            = "GoogleCloudPlatform/lb-http/google"
+-  version           = "~> 9.0"
++  source            = "GoogleCloudPlatform/lb-http/google"
++  version           = "~> 10.0"
+-  use_ssl_certificates    = false
++  create_ssl_certificate  = false
+  ssl                      = true
+  certificate_map          = var.cert_map_name
+```