Google Cloud Managed SSL certificates are free. You can only use Google managed SSL certificates with Google services such as load balancers. You cannot use them on services you control. Google does not make the private key unavailable. Services such as load balancers support more than one SSL certificate. Each Google managed certificate can have only one verified domain name. This can be a subdomain of a root domain you control. Wildcards are not supported. If any of the above limitations affect you, you will need to select self managed certificates. You can create your own SSL certificate with Cloud Shell.
chmod +x certbot-auto
./certbot-auto certonly --manual --preferred-challenges dns -d 'example.com' -d '*.example.com'