In this post, we're going to stand up the issuing CA. There's no rule that says your issuing CA needs to be the child of a Root CA owned by Google. If you already have an internal Root CA, you could submit the certificate request to that root, however that is outside of the scope of this post.

Google currently offers cloud based Certificate Authority in their suite of services available to enterprises. In this post, I'm going to stand up a new Root CA in the Google Cloud Platform.