Beyond GCP-only certificates.
Google Certificate Manager does exactly what its name says: it manages TLS certificates for Google-fronted workloads on GCP load balancers. Combined with GCP Certificate Authority Service, it covers a slice of the PKI story — the GCP slice. TigerTrust delivers full multi-cloud certificate lifecycle management, private-CA workflows, and machine-identity depth across your entire estate.
GCP-native, but not GCP-only.
Google Certificate Manager is well-integrated for GCP-fronted workloads. Teams add TigerTrust when the estate stretches beyond GCP or when they need lifecycle discipline across every certificate.
What changes when GCP is one cloud of many.
- Coverage scoped to GCP-managed certs on Google load balancers
- GCP CA Service is a separate product — not the same lifecycle plane
- No discovery of certificates outside the GCP surface
- Alerts require Cloud Monitoring + PubSub plumbing
- No prebuilt compliance evidence pack (SOC 2, PCI, HIPAA)
- Every certificate — GCP or not — in one inventory
- Google-managed, CA Service, and third-party CAs on one platform
- Discovery across GCP, AWS, Azure, and on-prem
- Multi-channel alerts with owner routing built in
- Prebuilt compliance evidence packs, audit-ready exports
Capability comparison, head to head.
Google Certificate Manager is well-designed for its scope. Here is where the offerings overlap and where the scope differs.
| Capability | TigerTrust | Google Certificate Manager |
|---|---|---|
GCP-native integration Google Certificate Manager is deeply integrated with GCP load balancers | ||
AWS and Azure integration | ||
On-premise / hybrid discovery | ||
Kubernetes across cluster types GKE Ingress integration is the primary K8s path | ||
Google-managed public certs Google is authoritative for its own managed certs; TigerTrust discovers and inventories them | ||
Private CA-issued workload certs GCP has this via a separate product — Certificate Authority Service | ||
IoT / device certificates | ||
Multi-CA orchestration (public + private) | ||
Prebuilt compliance reports | ||
Deployment to non-GCP endpoints |
Add TigerTrust above GCP.
You do not have to leave Google Certificate Manager. Most GCP-first teams keep it in place and add TigerTrust for the CLM layer.
Connect GCP
TigerTrust discovers Google-managed certs, CA Service-issued certs, and certificates deployed on load balancers, GKE, Cloud Run, and Apigee.
Extend discovery
Add AWS, Azure, on-prem load balancers, and Kubernetes clusters across the estate. Every certificate lands in one inventory.
Keep GCP as the front-door issuer
Google-managed and CA Service certs remain authoritative for their targets. TigerTrust adds visibility, ownership, and reporting around them.
Wire up policy and compliance
Assign owners, connect alerting channels, enable the compliance evidence pack, and set cross-CA policy for issuance routing.
Frequently asked questions
What does Google Certificate Manager actually cover?
It is scoped to certificates for GCP-fronted workloads — primarily Google-managed public TLS certificates attached to Global External Application Load Balancers, Cloud CDN, and related services. It handles issuance and renewal for those managed certs and lets you import self-managed certs for use with the same targets. It is not a general-purpose CLM.
How is it different from GCP Certificate Authority Service?
They are separate products. CA Service is Google's private CA (comparable to AWS Private CA); Certificate Manager is for provisioning TLS certs to Google load balancers. Neither on its own gives you cross-cloud discovery, lifecycle for non-GCP endpoints, or a compliance evidence pack.
We are fully on GCP. Do we need TigerTrust?
If every certificate you care about is a Google-managed cert on a Google load balancer, you may be fine with Certificate Manager alone. Most GCP-first teams still end up with some workload certs from CA Service, some shadow OpenSSL certs, and often an on-prem or SaaS footprint they did not plan for. TigerTrust unifies all of that.
Can TigerTrust manage the GCP-managed certificates too?
Yes — we discover and inventory them so they appear in the same view as everything else, and we watch renewal state so a GCP outage or misconfiguration on a managed cert still surfaces as an alert with an owner.
What about workload identity with SPIFFE/SPIRE on GKE?
That flow can continue unchanged. TigerTrust complements workload identity systems by covering the wider certificate estate — load balancers, third-party appliances, IoT devices, code signing, and cross-cloud endpoints that SPIFFE is not designed for.
Kept GCP Certificate Manager for storefronts, added cross-cloud coverage for everything else.
“Google Certificate Manager was perfect for our load balancers. It could not tell us about the certs on our GKE workloads, our AWS DR site, or our supplier appliances.”
GCP-native, plus every other cloud you actually run.
Google Certificate Manager and CA Service stay in place. TigerTrust ships the cross-cloud, on-prem, and multi-CA surface they do not.
Also worth comparing
TigerTrust vs AWS Private CA
The AWS equivalent — same cloud-locked scope, same multi-cloud gap.
TigerTrust vs Azure Key Vault
The Azure equivalent — the third of the cloud-native CLM trio customers evaluate together.
Certificate Lifecycle Automation
The CA-agnostic CLM that sits above Google Certificate Manager and every other cloud-native issuer.
Multi-cloud
The buyer journey for teams unifying certificate lifecycle across GCP, AWS, Azure, and on-prem.