A security engineer is configuring end-to-end encryption in transit between application microservices and a Google Cloud SQL for PostgreSQL database instance. The database instance is provisioned using a shared Certificate Authority (shared CA) mode and is accessed over Private Service Connect (PSC). To satisfy strict compliance and zero-trust policies, client connections must enforce complete cryptographic server identity verification to prevent spoofing and Man-in-the-Middle (MitM) attacks. Which configuration should the security engineer implement?

Retrieve the instance DNS name from Cloud SQL, create a DNS record for it in a VPC private Cloud DNS zone, and configure the database client to connect to that DNS name using sslmode=verify-full.: ### What Complete Server Identity Verification Is **Server identity verification** with TLS ensures that the client not only validates that the database server's certificate was signed by a trusted **Certificate Authority (CA)**, but also validates that the certificate's **Subject Alternative Name (SAN)** matches the exact hostname to which the client is connecting. ### How It Meets the Requirements - **Shared CA Identity Assurance**: When a Cloud SQL instance uses a **shared CA**, multiple database instances share the same root/intermediate CA. Validating only the CA chain is insufficient because any instance signed by that shared CA would be trusted. Enforcing hostname verification against the instance-specific SAN guarantees the identity of the specific target instance. - **Private Service Connect (PSC) Resolution**: Cloud SQL instances with a shared CA contain the instance DNS name (e.g., `INSTANCE_UID.PROJECT_DNS_LABEL.REGION_NAME.sql.goog.`) in the server certificate's SAN field. Registering this name in a **VPC private Cloud DNS zone** ensures that private clients correctly resolve the DNS name to the PSC endpoint IP. - **Client Verification Mode**: Setting `sslmode=verify-full` in PostgreSQL client drivers enforces both trusted CA validation and strict SAN hostname matching. ### Key Advantages - **MitM and Spoofing Prevention**: Prevents malicious or misconfigured instances sharing the same root CA from intercepting traffic. - **Private Route Integration**: Operates seamlessly inside private VPC networks via **Cloud DNS** and **Private Service Connect**. - **Zero-Trust Compliance**: Meets strict regulatory standards for data-in-transit authenticity and non-repudiation. ### Why This Is Optimal This solution properly aligns DNS resolution, certificate SAN metadata, and client TLS enforcement (`sslmode=verify-full`), providing end-to-end cryptographic trust.