[Cloud SQL person, SSL+connections is my jam]

When you say you couldn't get the root certs to work... what do you mean?

Cloud SQL automatically generates server certificates, and we offer UI+API for creating additional client certificates. The two should not share a root CA.