Certificate verify failed with new rds-ca-rsa2048-g1 CA

As far as I understand, you followed the documentation for rotate your certificates. There is a link where you can find global certificate bundles and per-region.

I have several ideas what could go wrong:

1. You have your, previously downloaded, global bundle and need to download a new one, compare them and replace if needed.
2. You are not using your .pem file as an argument for mysql connection but using a system wide certs. In the case you need follow the instruction for your OS how to update re-generate certificates globally.

Can you share the complete command with which you're connecting to RDS? This would help. Don't forget to remove your credentials. Alternatively, can you please tell us what are you working with? Is it a web application? Please be more specific as you can.

This is the complete command which we're using to connect to RDS ( pasted below), and it does currently work while we connect to MySQL RDS instance ( 5.7.mysql_aurora.2.11.5 version ) which uses Certificate authority ** rds-ca-2019**. While we update the certificate authority to rds-ca-rsa2048-g1 ( as rds-ca-2019 expires soon ), then it doesn't work and it errors out with the following message Unable to get local issuer certificate

Upon researching, seems like **Amazon RDS ** doesn't include the cert for the new certificate authority anymore. So, what is the solution ? Guess the new cert bundle for **rds-ca-rsa2048-g1 **should be included in Amazon RDS from AWS side. So that, we don't have to change anything on our end while updating CA, Correct me if I'm wrong :)

host: response.host, port: response.port, user: response.username, password: response.password, ssl: 'Amazon RDS', timezone: 'Z', database: '***',

We are working with a web application. One of our services is hosted in AWS, and we are connecting to the RDS from the code with the above configuration. Please let me know if you need any other details

Thanks.

I'm using the latest global-bundle.pem certificate and I verified it comparing it with the one from your link. It's where I downloaded it.

I'm also using the .pem file as an argument in all mysql connections. Two days ago I changed my connection string from rds-combined-ca-bundle.pem to global-bundle.pem and verified that the SSL connection was working as usual.

At the moment, I have no SSL routines::certificate verify failed error in my connection and I'm using the latest global-bundle.pem certificate. It's on the server that I had to go back to rds-ca-2019 certificate authority.

Currently we are connecting to MySQL RDS instance ( 5.7.mysql_aurora.2.11.5 version ) - SSL connection

Under the Database connection parameters, we specify SSL: ‘Amazon RDS’. As rds-ca-2019 is set to expire by August 22, 2024, we are in the process of updating the RDS CA to “rds-ca-rsa2048-g1”, but as soon as we update it, we are receiving the following error from the client while connecting it.

“Unable to get local issuer certificate”. 

Looking upon the reason and possible solutions, some suggest to manually download the certificate and add it to the Docker Image.
Is there any reason why we would need to do it. Can we just not use ‘Amazon RDS’, and it should include the new cert bundle for rds-ca-rsa2048-g1, right ?

Can we just use ‘Amazon RDS’, and include the new cert in it ? If so, is there any timeline at which the new cert bundle will be added to Amazon RDS ?

Is there a timeline of when this issue will be fixed ? i.e include the certificate in the 'Amazon RDS' bundle/ currently we are using SSL: 'Amazon RDS'. We are trying to avoid the following: Manually download the cert and then add it to the Docker image, pull it from the image and use it

Kindly suggest some solutions. Thank you.