Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-premises PKI should…

Using Certificate Manager for Google-managed public certificates bypasses the on-premises PKI entirely, which contradicts the implicit requirement to involve and minimally affect the existing on-premises PKI infrastructure.

Leveraging Google Certificate Authority Service to host a subordinate CA, which is then signed by the on-premises PKI, provides a scalable and managed solution for issuing many certificates. This approach minimizes the manual processes on the on-premises PKI by requiring it to sign only the subordinate CA once, while allowing the Google Cloud CA Service to handle subsequent, high-volume certificate issuance efficiently for HTTP load balancer frontends.

Using Certificate Manager to import certificates issued manually from an on-premises PKI would involve manual issuance and import for 'many' frontends, which is not scalable and does not minimize manual processes.

Referring to 'web applications with PKCS12 certificates from subordinate CA' is vague and does not directly address the scalable issuance and management of certificates specifically for HTTP Load Balancer frontends in Google Cloud, for which Certificate Manager or CA Service are the designated tools.