my goal is to do SSL pinning (mobile apps), with my cloud run backend

Plan A:

Creating a domain mapping for cloud run service, is there a no way to get the SSL cert? looks like its not possible.

Plan B:

Setup load balancer in front of cloud run
Followed instructions on https://cloud.google.com/load-balancing/docs/https/setting-up-https-serverless

Setup

1. “Create the load balancer” section > Frontend > create cert > Google managed cert. domain: “api.(mydomain).com”
2. “Connect your domain to your load balancer” section. I added this to my DNS: “record=A” “name=api” and “data=(load balancer ip address)”
3. testing load balancer. https://api.(mydomain).com -> load balancer address. works fine. but the load balancer ip address has no cert?

Questions with load balancer:

1. “reserved an external IP address” section. I reserved an external IP address. but what do i do with this? this is line 1 of image. looks like “create a load balancer” instructions already created an IP, see line 2 of image.
2. load balancer ip has no cert. but via https://api.(mydomain).com does. is that right?

other links i read

Configuring Cloud Run services and GCS Buckets with a load balancer