

## Step 1: Create a Certificate Authority (CA)

We'll start by generating our own CA, which will sign the server certificate.


### What is a Certificate Authority (CA)?

A Certificate Authority (CA) is an entity that issues digital certificates. These certificates confirm the identity of the server or client and establish trust in the encrypted connection. By creating your own CA, you take on the role of a trusted entity for your local environment.


### Create directories


```bash
mkdir -p https_server/certs && cd https_server/certs
```

### Generate CA private key


```bash
openssl genrsa -des3 -out myCA.key 2048
```

- **Note:** You'll be prompted to set a passphrase. Remember it; you'll need it later.



### Generate CA certificate

```bash
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.pem
```
- When prompted, you can leave fields blank or fill them as needed.


## Step 2: Install the CA certificate in the System Trust Store

Adding your CA to the system's trusted root certificates ensures that certificates signed by your CA are trusted.

### Install ca-certificates package

```bash
sudo apt update
sudo apt install -y ca-certificates
```


### Add your CA certificate

```bash
sudo cp myCA.pem /usr/local/share/ca-certificates/myCA.crt
sudo update-ca-certificates
```
- Output should include:
	```bash
	1 added, 0 removed; done.
	Adding debian:myCA.pem
	```


## Step 3: Generate a server certificate signed by your CA

### Generate server private key

```bash
openssl genrsa -out server.key 2048
```

### Create a Certificate Signing Request (CSR)

CSR contains information (e.g. common name, organization, country) the Certificate Authority (CA) will use to create your certificate. It also contains the public key that will be included in your certificate and is signed with the corresponding private key.

```bash
openssl req -new -key server.key -out server.csr
```

### Create a configuration file for extensions

Create a file named **server.ext** with the following content:

```ini
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
```

### Generate the server certificate
```bash
openssl x509 -req -in server.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out server.crt -days 825 -sha256 -extfile server.ext
```
- **Note:** Enter the CA passphrase when prompted.


## Step 4: Install the CA certificate in your browser

As the final step, add your CA certificate to your browser's trusted authorities.

### Google Chrome
1. Navigate to **Settings** > **Privacy and security** > **Security**.
2. Scroll down and click **Manage certificates**.
3. Select the **Authorities** tab.
4. Click **Import** and choose your **myCA.pem** file.
5. Check all trust options and confirm.



## Step 5: Create an HTTPS server in Go

Now, let's set up a simple HTTPS server using Go.


### Write the server code

Create a file named main.go in ~/https_server:


```go
package main

import (
	"crypto/tls"
	"fmt"
	"log"
	"net/http"
	"os"
	"time"
)

func index(w http.ResponseWriter, req *http.Request) {
	w.Header().Set("Content-Type", "text/plain")
	w.Write([]byte("Hello world!!!.\n"))
}

func ExecServer() error {
	mux := http.NewServeMux()
	mux.HandleFunc("/", index)

	// Load tls certificates
	serverTLSCert, err := tls.LoadX509KeyPair("certs/server.crt", "certs/server.key")
	if err != nil {
		log.Fatalf("Error loading certificate and key file: %v", err)
	}
	tlsConfig := &tls.Config{
		Certificates: []tls.Certificate{serverTLSCert},
	}

	serv := &http.Server{
		Addr:           ":8080",
		Handler:        mux,
		ReadTimeout:    10 * time.Second,
		WriteTimeout:   10 * time.Second,
		MaxHeaderBytes: 1 << 20,
		TLSConfig:      tlsConfig,
	}

	fmt.Println("### Server is starting... Listening on https://localhost:8080 ###")

	defer serv.Close()
	log.Fatal(serv.ListenAndServeTLS("", ""))

	return nil
}

func main() {
	if err := ExecServer(); err != nil {
		fmt.Fprintf(os.Stderr, "%s\n", err)
		os.Exit(1)
	}
}
```


### Run the server

```bash
cd ~/https_server
go run main.go
```

Open https://localhost:8080 in your browser.


You should see something like this:


![Server response](/static/media/hello.png "Server response")

Congratulations 🎉 🎉, you have an https server running using locally trusted certificates.

Remember that for production you have to obtain a certificate from a trusted CA.





If you're developing an application that requires HTTPS, you'll need a server with SSL/TLS certificates. While self-signed certificates can be used, browsers and systems don't trust them by default, leading to security warnings. In this guide, I'll show you how to create your own Certificate Authority (CA) and generate locally trusted certificates without using tools like mkcert. I'll also set up an HTTPS server in Go, but the principles apply to any programming language.

How to create a locally trusted HTTPS server in Linux



If you're eager to jump straight to the resources I used to study, [click here](#how-i-prepared). However, I recommend reading the entire post to gain insights into what it takes to prepare for the exam.

**Here is my certification:**

![Associate cloud engineer certificate](/static/media/associate_cloud_engineer.png "Associate cloud engineer certificate")

## Table of Contents

- [My cloud background](#my-cloud-background)
- [How I prepared](#how-i-prepared)
- [How much did it take me to prepare](#how-much-did-it-take-me-to-prepare)
- [My thoughts on the exam](#my-thoughts-on-the-exam)
- [Key topics to focus on](#key-topics-to-focus-on)

## My cloud background

As a graduate Computer Science student, I had a foundational understanding of cloud concepts but limited hands-on experience with Google Cloud Platform (GCP). I had previously worked with Kubernetes in one of my courses and, while doing a personal project, thanks to GCP's €300 free trial, I used Compute Engine VMs to deploy my server and Cloud SQL for the MySQL database. So I didn't have a deep knowledge of the GCP ecosystem but I wasn't starting from scratch. 

This probably gave me a slight edge when facing all the different GCP aspects, but I don't think it's necessary, and if you use the same resources I did to prepare for the exam, you will do at least as well as me.

Now to what you are probably expecting, let's dive into what resources I used to prepare for the exam.

## How I prepared


My primary study resource was **Google Cloud Skills Boost**. This platform covers nearly every concept that appears on the exam and provides practical labs through Qwiklabs. After each course, I studied the provided slides, which were invaluable for reinforcing the material.

I followed the **[Cloud Engineer Learning Path](https://www.cloudskillsboost.google/paths/52)**, focusing on the following courses:
- **[Google Cloud Fundamentals: Core Infrastructure](https://www.cloudskillsboost.google/paths/11/course_templates/60)**
- **[Essential Google Cloud Infrastructure: Foundation](https://www.cloudskillsboost.google/paths/11/course_templates/50)**
- **[Essential Google Cloud Infrastructure: Core Services](https://www.cloudskillsboost.google/paths/11/course_templates/49)**
- **[Elastic Google Cloud Infrastructure: Scaling and Automation](https://www.cloudskillsboost.google/paths/11/course_templates/178)**
- **[Getting Started with Google Kubernetes Engine](https://www.cloudskillsboost.google/paths/11/course_templates/2)**

*Note:* The Kubernetes course didn't have slides, but understanding the concepts and gaining hands-on experience with Kubernetes and GCP's different options for Kubernetes clusters is what you will need for the exam.


I also completed the following labs from the Cloud Engineer Learning Path:

- **[Implement Load Balancing on Compute Engine](https://www.cloudskillsboost.google/paths/11/course_templates/648)**
- **[Perform Foundational Infrastructure Tasks in Google Cloud](https://www.cloudskillsboost.google/paths/11/course_templates/637)**
- **[Set up and Configure a Cloud Environment in Google Cloud](https://www.cloudskillsboost.google/paths/11/course_templates/625)**
- **[Build Infrastructure with Terraform on Google Cloud](https://www.cloudskillsboost.google/paths/11/course_templates/636)**

These are all Qwiklabs labs that provide hands-on experience over various concepts, and although I wouldn't say they are necessary for the exam, they helped solidify my understanding. I also saved useful command lines from the labs for quick review before the exam.


The last Skills Boost resource I used was, **Preparing for Your Associate Cloud Engineer Journey**, this goes over each part of the exam and give you example questions. This is a nice resource to see what kind of concepts go into the exam, and test yourself a little with some example questions.


A few days before the exam, I watched the **[Google Cloud Associate Cloud Engineer Course - Pass the Exam!](https://youtu.be/jpno8FSqpc8?si=DyCHdmJ6GSBstMPP)** on YouTube.

This comprehensive course is highly recommended. It touches on some concepts that weren't covered in Skills Boost but can appear on the exam, such as DNS topics. However, I don't recommend this as the only source of study, as some of the content is already slightly outdated. Some services in GCP, although function very similarly, have changed their names, and that updated name is important to know in the exam, so I would recommend doing this after doing the Cloud Engineer Learning Path, as it's always nice to have the latest info.
 

I watched the video at 2x speed over the last three days before my exam, but I'd recommend allocating more time as I barely had enough time to finish it and properly digest the material.

Lastly, I practiced with the first 60 questions from **[ExamTopics](https://www.examtopics.com/exams/google/associate-cloud-engineer/view/)**. This resource is excellent for testing your knowledge. Only the first 60 questions are free, but that's sufficient for practice. Be cautious and verify answers by reading user discussions, as the provided solutions might not always be accurate.


**Recap**

If I was going to give you the essentials of what made the best impact in my preparation are the following:
- **[Google Cloud Fundamentals: Core Infrastructure](https://www.cloudskillsboost.google/paths/11/course_templates/60)**
- **[Essential Google Cloud Infrastructure: Foundation](https://www.cloudskillsboost.google/paths/11/course_templates/50)**
- **[Essential Google Cloud Infrastructure: Core Services](https://www.cloudskillsboost.google/paths/11/course_templates/49)**
- **[Elastic Google Cloud Infrastructure: Scaling and Automation](https://www.cloudskillsboost.google/paths/11/course_templates/178)**
- **[Getting Started with Google Kubernetes Engine](https://www.cloudskillsboost.google/paths/11/course_templates/2)**
- **[Google Cloud Associate Cloud Engineer Course - Pass the Exam!](https://youtu.be/jpno8FSqpc8?si=DyCHdmJ6GSBstMPP)** 
- **[ExamTopics](https://www.examtopics.com/exams/google/associate-cloud-engineer/view/)**

Access to Google Cloud Skills Boost will cost you $29 a month. I think it is worth it to do as much as you can in one month, as you will also have access to the slides to study after your subscription month is over. [Check it out here](https://www.cloudskillsboost.google/payments/new).


## How much did it take me to prepare 

In March 2024, my university offered the **Google Cloud Career Readiness** program through a university association (BAUC3M), providing access to the Cloud Engineer path. By April 26th, I had already completed most of the previously mentioned Cloud Engineer activities to prepare for a planned visit to Google's Madrid offices for which I really wanted to be prepared.

During August, I finished the remaining activities and scheduled my exam for September 30th. Throughout September, I reviewed the slides during my commute and dedicated a lot more time in the week leading up to the exam. As mentioned, I watched the video course and practiced questions in the last three days.

While I wish I'd started the video course earlier, overall, I'm satisfied with my preparation timeline. The duration you need may vary based on how quickly you internalize the material.


## My thoughts on the exam


I chose to take the exam **onsite** at a testing center in Madrid. While online proctoring is available, I read in another blog that, it comes with stringent technical requirements and potential hassles. The onsite environment was quiet, comfortable, and free of technical issues. Both options cost the same, so if you have the chance to choose, I would definitely recommend onsite proctoring.


While I can't share specific exam questions due to the NDA, I can provide some general insights on how I approach these types of exams:

- **Eliminate wrong answers**: Often, you can eliminate obviously incorrect options, narrowing down your choices.

- **Read carefully**: Pay attention to details in the questions. Small details can change the correct answer, such as the scope of a role or specific requirements in a scenario.

- **Time management**: The exam duration is two hours. I completed my first pass in about an hour, leaving sufficient time to review my answers.

- **Choose the best option**: You might think that the one you think is the correct is still not the best option available for what is being asked, it doesnt matter select the best one of the answers you are given.



## Key topics to focus on

To finish with I also want to go through some topics that could go into your exam and you should know, this are not the only ones, but are the ones I focused on the most.


- **Serverless and Cloud Run:** Understand serverless solutions and when to use **Cloud Run**. Understand the different computing solutions, and when to use which one. Be familiar with deploying applications using containers and how Cloud Run integrates with other GCP services.  **Traffic Splitting in Cloud Run:** Know how to deploy new revisions of applications in Cloud Run and manage traffic splitting between different versions.

- **Basic Cloud Shell commands:**
  
- **Roles and Permissions:** Pay close attention to **IAM roles and permissions**. Know the resource hierarchy. Understand the principle of least privilege, the differences between predefined roles and custom roles, and the scopes at which roles can be assigned (project, folder, organization).

- **Data Solutions:** Know the differences between **Cloud SQL**, **Cloud Spanner**, **BigQuery**, and **Cloud Bigtable**. Be prepared to choose the appropriate storage or database solution based on different scenarios involving relational and non-relational data. Know about **Cloud SQL Auth Proxy:** Be aware of secure ways to connect to Cloud SQL instances and when to use the Cloud SQL Auth Proxy.

- **Google Kubernetes Engine (GKE):** Understand the differences between **Autopilot** and **Standard** clusters. Familiarize yourself with deploying applications on GKE and managing clusters.

- **Load Balancing:** Be comfortable with all the different **load balancing options**, including HTTP(S) load balancing and network load balancing. Know what is a SSL certificate and when to use it.

- **Storage Options:** Understand the various storage classes in **Cloud Storage**, object lifecycle management. Be aware of how to implement policies like data retention and automatic deletion.

- **Billing accounts:** Know how **billing accounts** work, how to associate projects with billing accounts, and how to allow external users to analyze billing data using **BigQuery** and **Looker Studio**. Know that a resource can only be attached to one billing account and that one billing account can be used for multiple projects.

- **Service Accounts:** Understand what service accounts are, how they are used, and the differences between user-managed and default service accounts.

- **Compute Options:** Be familiar with choosing between **Compute Engine**, **App Engine**, **Cloud Run**, **Managed Instance Groups (MIGs)**, and **GKE** based on application requirements.

- **Data Processing Services:** Know the use cases for **BigQuery**, **Cloud Dataflow**, **Cloud Dataprep**, and **Cloud Dataproc**. Understand how these services fit into data processing and analytics workflows.

- **Virtual Machines:** Understand the differences between regular VMs and **Spot VMs**, when to use each, and how snapshots work for backup and recovery. Also know when to use **HDD vs. SSD**


- **DNS and Networking Concepts:** Be prepared for topics on DNS records (like CNAME and A records), and general networking concepts within GCP.

- **Terraform and Infrastructure as Code:** Understand what is the pourpus of Terraform and how is used with GCP.




For everyone who's nervous about taking on the Google Cloud Associate Cloud Engineer exam, I'm here to share the steps I followed to pass it successfully. If you're wondering how to prepare, what resources to use, and what to expect on exam day, this guide is for you.

Hey! 😄

My name is Jorge Martinez and this is my blog.

Recent Posts