組織で管理されているカスタム DNS 名を使用してアプリケーションが接続できるように、Cloud SQL インスタンスを構成できます。IP アドレスではなくカスタム DNS 名を使用して Cloud SQL インスタンスに接続する場合は、カスタム サブジェクト代替名（SAN）を構成します。カスタム SAN は、インスタンスの作成時または更新時に構成できます。
カスタム DNS 名をカスタム SAN 構成としてインスタンスに追加すると、Cloud SQL はカスタム DNS 名をインスタンスのサーバー証明書の SAN フィールドに挿入します。このカスタマイズにより、ホスト名の検証でカスタム DNS 名を安全に使用できます。カスタム SAN 構成には、最大 3 つのカスタム DNS 名をカンマ区切りで追加できます。セキュリティ上の理由から、カスタム SAN 構成は、サーバー CA モードとして CUSTOMER_MANAGED_CAS_CA で構成したインスタンスでのみ使用できます。
クライアントとアプリケーションでカスタム DNS 名を使用してインスタンスに接続する前に、DNS 名と IP アドレスのマッピングを設定します。これは DNS の解決と呼ばれます。非公開で接続する場合は、対応する Virtual Private Cloud（VPC）ネットワークの限定公開 DNS ゾーンに DNS レコードを作成します。
たとえば、インスタンスの接続文字列は my-project:region:my-instance ですが、DNS 名 prod-db.mycompany.example.com を使用して接続する場合などです。会社のネットワーク上のインスタンスの IP アドレスが 192.0.2.4 の場合は、次の DNS レコードを作成します。
Record type: A
Name: prod-db.mycompany.example.com
Value: 192.0.2.4
TTL: 600
Record type: TXT
Name: prod-db.mycompany.example.com
Value: my-project:region:my-instance
TTL: 600
カスタム DNS 名を使用してインスタンスに接続する
Cloud SQL for SQL Server インスタンスに接続する場合は、カスタム DNS 名をホスト名として構成します。次に、sqlcmd に -N フラグを指定するか、SSMS の [Encrypt Connection/Encryption] オプションを選択して、サーバー ID の検証を有効にします。
他の SQL Server ドライバにも同様のフラグまたは構成があります。
外部ネットワークからプライベート Cloud SQL インスタンスに接続する場合は、外部接続を許可し、Cloud DNS がオンプレミス システムと通信できるように、Cloud SQL インスタンスとその Virtual Private Cloud（VPC）ネットワークを構成する必要があります。この構成の詳細については、外部ソースから接続するとオンプレミス システムの DNS を構成するをご覧ください。
制限事項
Cloud SQL インスタンスのサーバー証明書に、カスタム SAN 値として 3 つを超える DNS 名を追加することはできません。
インスタンスのカスタム SAN 値として証明書に追加できる DNS 名の最大長は 253 文字です。
インスタンスの証明書に追加する DNS 名には、ワイルドカード文字（*）や末尾のドットを含めることはできません。たとえば、test.example.com. は許可されません。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-30 UTC。"],[],[],null,["# Set up a custom DNS name for a Cloud SQL instance\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/custom-dns-name \"View this page for the MySQL database engine\") \\| [PostgreSQL](/sql/docs/postgres/custom-dns-name \"View this page for the PostgreSQL database engine\") \\| SQL Server\n\n\u003cbr /\u003e\n\nThis page describes how to set up a custom domain name system\n(DNS) name for your Cloud SQL instance.\n\nOverview\n--------\n\nYou can configure a Cloud SQL instance so that your applications can\nconnect using a custom DNS name managed by your organization.\nIf you want to use a custom DNS name to connect to a Cloud SQL\ninstance instead of using an IP address, then configure a custom\nsubject alternative name (SAN). You can configure a custom SAN\nwhen you create or update an instance.\n\nWhen you add a custom DNS name as a custom SAN configuration to your instance,\nCloud SQL inserts the custom DNS name\nto the SAN field of the server certificate of the instance. This customization\nlets you use the custom DNS name with [hostname validation](/sql/docs/sqlserver/configure-ssl-verification#server-identity-verification) securely.\nYou can add a comma-separated list of up to three custom DNS names to the\ncustom SAN configuration. For security reasons, you can use a custom SAN configuration\nonly for instances that you\n[configure with `CUSTOMER_MANAGED_CAS_CA`](/sql/docs/sqlserver/customer-managed-ca)\nas the server CA mode.\n\nAfter you configure the custom DNS name for your instance, you can use that\ncustom DNS name to connect your database clients or applications, including\n[Cloud SQL Language Connectors](/sql/docs/sqlserver/language-connectors) and\nthe [Cloud SQL Auth Proxy](/sql/docs/sqlserver/sql-proxy).\n\n### Workflow\n\nTo set up a custom DNS name for an instance, do the following:\n\n1. Create an instance configured with customer-managed CA.\n2. Add custom SAN values to the instance. The custom SAN values are inserted into the SAN field of the server certificate of the instance.\n3. Determine the IP address of the instance.\n4. Create custom DNS records for your instance.\n5. Connect to the instance using the custom DNS name.\n\nBefore you begin\n----------------\n\nBefore you set up a custom DNS name for your instance, make sure you have\nthe [required roles and permissions](/sql/docs/sqlserver/customer-managed-ca#required-roles).\n\nIf you are creating a new Cloud SQL instance, then to use custom SAN,\nyour instance must also use a\n[customer-managed certificate authority (CA)](/sql/docs/sqlserver/customer-managed-ca) for its\nserver CA mode.\n\nCreate an instance with custom SAN values\n-----------------------------------------\n\nTo create an instance with custom SAN values, use the following [gcloud sql instances create](/sdk/gcloud/reference/sql/instances/create) command: \n\n### gcloud\n\n```bash\ngcloud sql instances create \"\u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e\" \\\n --database-version=DATABASE_VERSION \\\n --project=PROJECT_ID \\\n --region=REGION \\\n --server-ca-mode=CUSTOMER_MANAGED_CAS_CA \\\n --server-ca-pool=projects/PROJECT_ID_CAS/locations/REGION/caPools/CA_POOL_ID\n --custom-subject-alternative-names=CUSTOM_DNS_NAME\n```\n\nMake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e with the name of the Cloud SQL instance that you want to create.\n- \u003cvar translate=\"no\"\u003eDATABASE_VERSION\u003c/var\u003e with the [`enum` of the version](/sql/docs/sqlserver/admin-api/rest/v1/SqlDatabaseVersion) of the Cloud SQL instance that you want to create.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the ID of the project where you plan to create your Cloud SQL instances.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID_CAS\u003c/var\u003e with the ID of the project where you created your \u003cvar translate=\"no\"\u003eCA_POOL_ID\u003c/var\u003e. This project might be the same or different from where you want to create your Cloud SQL instance.\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region where you created the CA pool. You must create your instance in the same region as the CA pool.\n- \u003cvar translate=\"no\"\u003eCA_POOL_ID\u003c/var\u003e with the ID of the CA pool that you created.\n- \u003cvar translate=\"no\"\u003eCUSTOM_DNS_NAME\u003c/var\u003e with up to three custom DNS names, comma-separated with no spaces in between the values. For example, `develop.example.com,test.example.com,production.example.com`.\n\nAdd or update custom SAN values for an instance\n-----------------------------------------------\n\nTo add or update custom SAN values for an existing instance,\ndo the following: \n\n### gcloud\n\n```bash\ngcloud sql instances patch INSTANCE_NAME \\\n --custom-subject-alternative-names=CUSTOM_DNS_NAME\n```\nCaution: If you're updating an instance that already has custom SAN values, then specify the existing custom SAN values or the existing values will be replaced.\n\nMake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e with the name of the Cloud SQL instance that you want to update.\n- \u003cvar translate=\"no\"\u003eCUSTOM_DNS_NAME\u003c/var\u003e with up to three custom DNS names, comma-separated with no spaces in between the values. For example, `develop.example.com,new-test.example.com,production.example.com`.\n\nClear all custom SAN values from an instance\n--------------------------------------------\n\nTo clear all custom SAN values from an instance,\ndo the following: \n\n### gcloud\n\n```bash\ngcloud sql instances patch INSTANCE_NAME \\\n --clear-custom-subject-alternative-names\n```\n\nReplace \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e with the name of the Cloud SQL\ninstance that you want to update.\n\nCreate custom DNS records\n-------------------------\n\nBefore you can connect to the instance using the custom DNS name with\nyour clients and applications, set up the mapping between the DNS name\nand the IP address. This mapping\nis known as DNS resolution. If you are connecting privately, then\n[create the DNS record in a private DNS zone](/dns/docs/set-up-dns-records-domain-name)\nin the corresponding Virtual Private Cloud (VPC)\nnetwork.\n\nTo create custom DNS records for your instance, do the following:\n\n1. Retrieve the IP address for your instance. Run the following command:\n\n ```bash\n gcloud sql instances describe INSTANCE_NAME \\\n --project=PROJECT_ID\n ```\n\n Make the following replacements:\n - \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e: the name of the Cloud SQL instance\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID or [project number](/resource-manager/docs/creating-managing-projects#identifying_projects) of the Google Cloud project that contains the instance\n2. In the response, look for the\n `ipAddresses:` field.\n\n For example: \n\n ipAddresses:\n - ipAddress: 192.0.2.4\n type: PRIVATE\n\n You can retrieve the private IP address for an instance configured for\n [private services access](/sql/docs/sqlserver/configure-private-services-access), [Private Service Connect](/sql/docs/sqlserver/configure-private-service-connect), or [both](/sql/docs/sqlserver/configure-private-services-access-and-private-service-connect).\n | **Warning**: For security reasons, we don't recommend setting up custom DNS records for the public IP address of an instance.\n3. Add two DNS records to a DNS zone used by your application.\n You can use a DNS server that you manage yourself or\n the [Cloud DNS private zone](/dns/docs/zones#create-private-zone) used by your application.\n\n - Create an `A` record for the IP address of the instance\n - Create a `TXT` record containing the instance connection name.\n\n Standard database clients use the `A` record to look up the IP address\n to make the connection. Cloud SQL Language Connectors and the Cloud SQL Auth Proxy\n use the `TXT` record to look up the instance connection name.\n\n For example, the connection string for your instance is `my-project:region:my-instance`,\n but you want to connect using the DNS name\n `prod-db.mycompany.example.com`.\n If the IP address of the instance on your company network is `192.0.2.4`,\n then create the following DNS records: \n\n Record type: A\n Name: prod-db.mycompany.example.com\n Value: 192.0.2.4\n TTL: 600\n\n Record type: TXT\n Name: prod-db.mycompany.example.com\n Value: my-project:region:my-instance\n TTL: 600\n\nConnect to an instance using a custom DNS name\n----------------------------------------------\n\nWhen you connect to the Cloud SQL for SQL Server instance, configure the custom DNS name as the hostname. Then enable server identity verification verification by specifying the `-N` flag for `sqlcmd` or by selecting the **Encrypt Connection/Encryption** option of SSMS.\n\n\u003cbr /\u003e\n\nOther SQL Server drivers have similar flags or configurations.\n\n\nIf you're connecting to a private Cloud SQL instance\nfrom an external network, then you must configure your Cloud SQL instance\nand its Virtual Private Cloud (VPC) network to permit external\nconnections and to let Cloud DNS communicate with on-premises\nsystems. For more information about this configuration, see [Connect from an external source](/sql/docs/mysql/configure-private-ip#vpn) and [Configure DNS for on-premises systems](/vpc/docs/configure-private-google-access-hybrid#config-dns-onpremises).\n\nLimitations\n-----------\n\n- You can't add more than three DNS names as custom SAN values to the server certificate of a Cloud SQL instance.\n- The maximum length of a DNS name that you can add to the certificate as a custom SAN value for an instance is 253 characters.\n- The DNS names that you add to the certificate for an instance can't have wildcard characters (`*`) or trailing dots. For example, `test.example.com.` isn't allowed.\n- The DNS names must be valid, as specified by [RFC 1034](https://datatracker.ietf.org/doc/html/rfc1034).\n- You can specify custom SAN values for `CUSTOMER_MANAGED_CAS_CA` instances only.\n\nWhat's next\n-----------\n\n- [Manage](/sql/docs/sqlserver/manage-ssl-instance) SSL/TLS certificates on your Cloud SQL instance.\n- Learn more about [how encryption is handled in Google Cloud](/security/encryption-in-transit)."]]
