AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
Steps for Databases (25) requiring certificate update to "rds-ca-rsa2048-g1"
Hi re:Post,
We have a set of PostgreSQL instances that require their certificates to be updated.
In looking at the update via the console process, it seems pretty straight forward but I wanted to contact re:Post and double-check/verify.
[ ] Is "rds-ca-rsa2048-g1" recommended for the Ohio region / us-east-2?
In selecting the "Schedule Update" we see the following screen which recommends "rds-ca-rsa2048-g1"
and that the db does not require a restart.
Or are we done?
Thank you for your time and help!
Best Regards,
Donald
- 言語
- English
質問済み 2年前1251ビュー
- 新しい順
- 投票が多い順
- コメントが多い順
Hello,
Yes, Before applying the new certificate to your DB instances, update the trust store of any clients and applications that use SSL/TLS and the server certificate for connections.
To check if the application using SSL connection, please check this documentation https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/ssl-certificate-rotation-postgresql.html#ssl-certificate-rotation-postgresql.determining-server
You can download the TLS/SSL certificates from the following link: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions
Reference:
Hi Sivaraman, thank you for your quick reply and help. Regarding, "update the trust store of any clients and applications that use SSL/TLS and the server certificate for connections." beside the RDS instances, we have our application running on hundreds of apple I-phones. How would we get the downloaded "global-bundle.pem" to those devices? Thank you for your time and help! Best Regards, Donald
Are you sure your iPhones have DIRECT access to the database? That would be very unsual for an application. Plus rds-ca-2019 is unlikely to be on your iphones anyway..
Right, of course Gary. Yeah the iPhones would not direct access to the dbs. I'm new to the dev shop in my company and glad I asked here vs in a meeting! Thanks! Donald