CERTIFICATE_VERIFY_FAILED when mapping Cloud Run custom domain via CNAME

Question

CERTIFICATE_VERIFY_FAILED when mapping Cloud Run custom domain via CNAME
Goal: Verify that a custom domain mapped to a Cloud Run service can be accessed over HTTPS without TLS hostname mismatch errors. The current setup uses a CNAME record pointing the subdomain to the Cloud Run service URL. Clients report CERTIFICATE_VERIFY_FAILED during TLS handshake.
Constraints: Cloud DNS supports CNAME only for subdomains; root domains require A or ALIAS records. Cloud Run domain mapping creates a managed SSL certificate that matches the custom domain. It is unclear whether Cloud DNS performs CNAME flattening for the purpose of hostname verification, which may cause the TLS client to validate against the CNAME target rather than the original hostname.
Unresolved questions:

Does Cloud DNS automatically flatten CNAME chains when a client performs TLS hostname verification for a Cloud Run custom domain?
If flattening is not performed, what record type should be used to avoid CERTIFICATE_VERIFY_FAILED while maintaining the custom domain mapping?
Are there documented differences in certificate validation behavior between using A/ALIAS records versus CNAME records for Cloud Run domain mappings?

Tasadduq Burney · Answer

CERTIFICATE_VERIFY_FAILED when mapping Cloud Run custom domain via CNAME
When you map a custom domain to a Cloud Run service Cloud Run provisions a managed SSL certificate for the exact domain you provide. If you use a CNAME record in Cloud DNS to point that domain at the Cloud Run service URL TLS clients may perform hostname verification against the resolved CNAME target rather than the original custom domain triggering the CERTIFICATE_VERIFY_FAILED error.
Likely explanation
Cloud DNS does not automatically flatten CNAME chains for TLS hostname verification. The clients TLS library validates the certificate against the hostname it connects to; if that hostname resolves through a CNAME some implementations check the final target (the Cloud Run .run.app subdomain) not your custom domain. The certificate issued by Cloud Run matches your custom domain so the mismatch causes the error.
Confirmed facts

Cloud Run managed SSL certificates are issued for the custom domain you map regardless of DNS record type.
Cloud DNS rejects CNAME records at the apex (root) domain an ALIAS or A record is required there.
For subdomains a CNAME is permitted but TLS verification behavior depends on the client implementation.

Recommended verification steps

Run dig +short custom.domain in Cloud DNS; note whether the answer is an IP (A/ALIAS) or a CNAME chain.
Run openssl s_client -connect custom.domain:443 and confirm the certificates Subject Alternative Name lists your custom domain not the CNAME target.
If you are using a CNAME at a subdomain and see the error consider switching to an ALIAS record pointing to the Cloud Run services load-balanced hostname or ensure your TLS library uses the original hostname for verification.
If the custom domain is an apex domain you must use an ALIAS or A record; a CNAME will not be accepted by Cloud DNS.

To determine the right fix I need to know: is your custom domain an apex domain (e.g. example.com) or a subdomain (e.g. run.example.com) and what DNS record type is currently configured?

CERTIFICATE_VERIFY_FAILED when mapping Cloud Run custom domain via CNAME