Unable to connect to Google Cloud SQL using PHP PDO and SSL - php

Question

I am trying to connect to my Google Cloud SQL instance using PHP PDO. If I don't enforce SSL, everything works fine. But if I enforce SQL, I am unable to connect.
I have downloaded the server certificate from my Google Cloud SQL instance, as well as the client certificate (and matching key that I created). I know they're OK, because the following line works fine from the command shell:
mysql -h[myHostIp] -uroot -p --ssl-ca=settings/server-ca.pem --ssl-cert=settings/client-cert.pem --ssl-key=settings/client-key.pem [myDatabase]
However, from the same folder in a standalone PHP file run from the command line, the following PHP code does not:
<?php
$myHostIp = '[myHostIp]';
$myDbName = 'qabtk';
$myDbUser = 'root';
$myDbPassword = '[myPassword]';
$db = new PDO("mysql:host=$myHostIp;dbname=$myDbName", $myDbUser, $myDbPassword, [
PDO::MYSQL_ATTR_INIT_COMMAND => "set names 'utf8'",
PDO::MYSQL_ATTR_SSL_KEY =>'settings/client-key.pem',
PDO::MYSQL_ATTR_SSL_CERT=>'settings/client-cert.pem',
PDO::MYSQL_ATTR_SSL_CA =>'settings/server-ca.pem',
]);
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = 'show databases';
$stmt = $db->prepare($sql);
$stmt->execute([]);
$answer = $stmt->fetchObject();
$stmt->closeCursor();
var_dump($answer);
exit;
Running that code gives the following error:
Trace/BPT trap: 5
If I remove both the client key and client certificate, leaving in only the server certificate, the error changes to:
Uncaught PDOException: SQLSTATE[HY000] [1045] Access denied for user 'root'#'[client IP address]' (using password: YES)
I've tried the recommendation of adding a PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => false, which doesn't make any difference.
Help please!
UPDATE 2022-04-12: I am using this on an Apple silicon Macbook Pro, both directly using MacOS, and inside a Docker container running Ubuntu 18.04. The problem has now disappeared for no apparent reason - there's been much rebooting of many of the components and I didn't track exactly when it went away. However, it requires the line PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => false to work which it really shouldn't do. I believe this may be to do with the way Google sets the CN in its certificates for Cloud SQL, but I'm not certain.