Aurora Postgresql RDS SSL/TLS connectivity

0

We have created a Aurora Postgresql RDS cluster for version 16 and enabled rds.forcessl. When establishing connection to this instance using psql from EC2 (Amazon Linux 2023) instance, we could see that the SSL has been enabled.

Using the below command from PSQL: psql "host=<hostname> port=<port> dbname=<databasename> user=<databaseuser> sslmode=verify-ca sslrootcert=global-bundle.pem"

When using this we see that it still prompts for the password. Can you please help us know why the password is being prompted though the connection was SSL and have the cluster configured with certificated and validating using the root cert from the client (psql).

Tried with different ssl modes like verify-full or prefer or others but still does not help. Even the root cert specific to a region as well did not help.

This is blocking us from moving forward.

3 Answers
1

Hello.

With PostgreSQL's SSL connection, the communication is only encrypted with SSL, and password authentication cannot be omitted.
https://repost.aws/knowledge-center/aurora-postgresql-ssl-certificates

profile picture
EXPERT
answered 20 days ago
profile picture
EXPERT
reviewed 20 days ago
profile pictureAWS
EXPERT
reviewed 20 days ago
0

Thank you for the quick responses. But we can establish the client authentication as well enabled for non-RDS Postgres using the "verify-full" setting while supporting other different ways of authentication using the certificates. Is there a way to configure the RDS PostgreSQL cluster so that the client validation can be enabled?

Thank you,

answered 19 days ago
0

I think you misunderstand the purpose of SSL/TLS and the certificate in this scenario. It allows the PostgreSQL client (on the EC2 instance) to validate that the server it connects to is really what it claims to be. And after that, it's used to securely encrypt communications between the client and the server.

Nowhere is it used by the server to authenticate the client, that still needs a password (or equivalent like a ~/.pgpass file or $PGPASSWORD environment variable).

profile picture
EXPERT
Steve_M
answered 20 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions