I managed to solve the SSL problem by adding a Google-managed certificate at the cluster-level. I’m pretty sure I used the cloud console, i.e. no command-line anything.
https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs
Full disclosure: I’ve no idea what I’m doing.