Terminating mTLS at the Cloud Run service level behind an External HTTPS Load Balancer

Google Cloud Compute Infrastructure
,
1

Hi everyone,

We are designing an architecture where we need to enforce mutual TLS (mTLS) for specific services. However, due to some organizational constraints, we are not able to configure the mTLS policy directly on our Global External HTTPS Load Balancer.

Our goal is to find a way to terminate mTLS at the application level, specifically within our Cloud Run service, which sits behind the load balancer.

Our proposed flow is:

  1. The External HTTPS Load Balancer receives the TLS connection from the client.

  2. The load balancer forwards the client certificate information (passthrough) to the backend Cloud Run service via HTTP headers.

  3. Our application code within the Cloud Run service inspects these headers, validates the client certificate, and then decides whether to accept or reject the request.

My questions are:

  • Is this a supported and recommended pattern for achieving application-level mTLS with Cloud Run?

  • What is the correct configuration on the External HTTPS Load Balancer to enable this client certificate passthrough?

  • Are there any best practices or potential pitfalls we should be aware of when implementing the certificate validation logic within the Cloud Run service itself?

Any guidance, examples, or insights from the community would be greatly appreciated.

Kind Regards,

Subhajit

1 Like
2

Hi Subhajit, I am not sure if you have a solution to your use case above, however, based on what you have explained, Set up backend authenticated TLS  |  Cloud Load Balancing  |  Google Cloud Documentation should work with Trust config stores as certificate validation with cloud run. hope this helps.

3

Hi @subhajit2022 This is not a secure or supported way to implement mTLS With an External HTTPS Load Balancer TLS terminates at the load balancer and Cloud Run cannot receive the real client certificate There is no true certificate passthrough to Cloud Run Validating headers in the app is unsafe unless the load balancer performs mTLS and injects verified identity The correct approach is to configure mTLS on the load balancer or use a proxy like Envoy in front of Cloud Run