CERTIFICATE_VERIFY_FAILED when mapping Cloud Run custom domain via CNAME

CERTIFICATE_VERIFY_FAILED when mapping Cloud Run custom domain via CNAME

Goal: Verify that a custom domain mapped to a Cloud Run service can be accessed over HTTPS without TLS hostname mismatch errors. The current setup uses a CNAME record pointing the subdomain to the Cloud Run service URL. Clients report CERTIFICATE_VERIFY_FAILED during TLS handshake.

Constraints: Cloud DNS supports CNAME only for subdomains; root domains require A or ALIAS records. Cloud Run domain mapping creates a managed SSL certificate that matches the custom domain. It is unclear whether Cloud DNS performs CNAME flattening for the purpose of hostname verification, which may cause the TLS client to validate against the CNAME target rather than the original hostname.

Unresolved questions:

• Does Cloud DNS automatically flatten CNAME chains when a client performs TLS hostname verification for a Cloud Run custom domain?
• If flattening is not performed, what record type should be used to avoid CERTIFICATE_VERIFY_FAILED while maintaining the custom domain mapping?
• Are there documented differences in certificate validation behavior between using A/ALIAS records versus CNAME records for Cloud Run domain mappings?