Google Trust Services (GTS) is a publicly-trusted CA operated by Google. TigerTrust integrates with GTS through the standard ACME protocol with External Account Binding, so you can automate issuance and renewal of publicly-trusted TLS certificates through your Google Cloud project without stepping outside the TigerTrust workflow.
Google Trust Services

​
What it is

You register GTS as a Certificate Authority in TigerTrust using EAB credentials from your Google Cloud project. Once registered, TigerTrust handles the full ACME order flow — challenge completion, certificate pickup, and renewal — with GTS as the issuer. GTS also publishes renewal timing recommendations (ARI) per certificate, which TigerTrust uses to fire renewals at the optimal moment.

​
When to use it

  • Automate issuance of publicly-trusted TLS certificates through an existing Google Cloud contract.
  • Replace manually-managed GTS certificate renewals with fully automated ACME-based renewals in TigerTrust.
  • Issue wildcard certificates via DNS-01 challenge with an automated DNS provider integration.
  • Benefit from ARI-optimized renewal timing for GTS-issued certificates without additional configuration.

​
Set it up

1

Obtain EAB credentials from Google Cloud

In the Google Cloud Console, navigate to Certificate Manager and create an EAB key. Copy the Key ID and HMAC key — the HMAC key is shown only once.
2

Add a new CA in TigerTrust

Go to Certificate Authorities > Add and select Google Trust Services from the CA type dropdown.
3

Enter the EAB credentials

Paste the EAB Key ID and HMAC key. Add your Google Cloud project ID for billing attribution. Select http-01 or dns-01 as the challenge type (dns-01 is required for wildcard certificates).
4

Test the connection

Click Test connection. TigerTrust verifies the EAB binding and confirms it can reach the GTS ACME directory. A green confirmation means the CA is ready to use.
5

Save and issue

Click Save. GTS now appears in the issuer dropdown for any certificate template or manual issuance.

​
What you’ll see

After saving, the Certificate Authorities page lists Google Trust Services with type GTS and the connection test result. Certificates issued through this CA show GTS as the issuer in the inventory. The certificate detail page shows the ARI renewal window once TigerTrust has fetched it from the CA.
EAB credentials issued by Google Cloud are single-use for account binding — once TigerTrust creates an ACME account with them, the credentials cannot be reused for a second account. Store the HMAC key securely before entering it into TigerTrust; GTS does not show it again after issuance.

​
Tips

  • For wildcard certificate automation with dns-01, pair this CA with a DNS provider integration in Integrations > DNS Providers.
  • GTS publishes ARI renewal windows per certificate. See Renewal Info ARI to understand how TigerTrust uses this data to time renewals.

GlobalSign Atlas

Alternative publicly-trusted CA using a proprietary REST API.

ACME

ACME protocol details, challenge handling, and automation.

Renewal Info ARI

GTS publishes ARI — TigerTrust uses it for optimal renewal timing.