RDS certificate bundle is no longer trusted by MacOS Catalina

Question

So we're trying to SSH tunnel into a DocumentDB instance, which enforces using the new CA bundle and TLS (And we'd always want to use TLS). The problem we have is the new certs were made after June 2019, which means they're subject to the new cert validity rules (if the cert isn't in MacOS's trust store). This is a maximum validity of 825 days, the RDS certs are 5 years which is over this. https://support.apple.com/en-gb/HT210176 So anytime we try to connect from our laptops, it ends up failing with this error from the mongo-shell.  
  
2020-03-19T15:38:20.802+0100 E  NETWORK  \[js] SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_CERT_SUSPENDED; connection rejected  
2020-03-19T15:38:20.803+0100 E  QUERY    \[js] Error: couldn't connect to server 127.0.0.1:27017, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_CERT_SUSPENDED; connection rejected :  
connect@src/mongo/shell/mongo.js:341:17  
@(connect):2:6  
2020-03-19T15:38:20.806+0100 F  -        \[main] exception: connect failed  
2020-03-19T15:38:20.806+0100 E  -        \[main] exiting with code 1  
  
If other OS's like Linux start enforcing this it could potentially break a lot of things? Is it possible to get a shorter lived certificate for this bundle? or cross sign it with the Amazon Root CA's?

Answer

Mac OS X Catalina has updated the requirements for trusted certificates. Trusted certificates must now be valid for 825 days or fewer (see https://support.apple.com/en-us/HT210176). Amazon DocumentDB instance certificates are valid for over four years, longer than the Mac OS X maximum. In order to connect directly to an Amazon DocumentDB cluster from a computer running Mac OS X Catalina, you must allow invalid certificates when creating the TLS connection. In this case, invalid certificates mean that the validity period is longer than 825 days. You should understand the risks before allowing invalid certificates when connecting to your Amazon DocumentDB cluster.  
  
To connect to an Amazon DocumentDB cluster from OS X Catalina using the AWS CLI, use the tlsAllowInvalidCertificates parameter.  
  
mongo --tls --host  --username  --password  --port 27017 --tlsAllowInvalidCertificates

Answer

Same problem here on macos :   
  
2020-03-20T12:52:16.461+0100 E  NETWORK  \[js] SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_CERT_SUSPENDED; connection rejected  
2020-03-20T12:52:16.461+0100 E  QUERY    \[js] Error: couldn't connect to server xxx.eu-west-1.docdb.amazonaws.com:27017, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_CERT_SUSPENDED; connection rejected :  
connect@src/mongo/shell/mongo.js:341:17  
  
My documentdb instance uses 2019 certificate and I tried with rds-ca-2019-eu-west-1.pem, rds-ca-2019-root.pem and rds-combined-ca-bundle.pem.

Answer

Please see: "What if I’m having issues connecting directly to my Amazon DocumentDB cluster from Mac OS X Catalina?" here: https://docs.aws.amazon.com/documentdb/latest/developerguide/ca_cert_rotation-temp.html

RDS certificate bundle is no longer trusted by MacOS Catalina

Relevant content