Can not connect to Postgres over DB Proxy (TLS issue)

It seems that your RDS instance is not properly configured to support SSL connections. Could you please revisit and follow the steps outlined in the guide Using SSL/TLS to encrypt a connection to a DB instance or cluster to ensure that all configurations are correct?

Hello.

Here is the output:

ubuntu@pc:~$ openssl s_client -connect MY_PROXY_ENDPOINT_HERE.us-east-1.rds.amazonaws.com:5432 -showcerts

CONNECTED(00000003)

I do not observe any information related with ssl handshake unfortunately.

If to connect to DB there is also no any useful information.

ubuntu@pc:~$ openssl s_client -connect MY_DB_ENDPOINT_HERE.us-east-1.rds.amazonaws.com:5432 -showcerts
CONNECTED(00000003)
4037E0C8F57F0000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:308:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 369 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

I have checked our DB server configuration. There is only option to change Root CA and nothing else in case of ssl adjustments. And, as i told before our app can connect over SSL to DB directly using the mentioned cert and its Root CA (rds-ca-rsa2048-g1), but not via DB proxy. So, it looks like that everything is fine with DB server itself.

ubuntu@pc:~$ psql "host=MY_DB_HOST_HERE.us-east-1.rds.amazonaws.com port=5432 dbname=postgres user=postgres sslmode=require sslrootcert=cert.pem"
Password for user postgres:
psql (15.6 (Ubuntu 15.6-1.pgdg22.04+1), server 15.5)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, compression: off)
Type "help" for help.

postgres=>

now lets connect to db over proxy:

psql "host=MY_RDS_PROXY_HERE.us-east-1.rds.amazonaws.com port=5432 dbname=postgres user=postgres sslmode=require sslrootcert=cert.pem"
psql: error: connection to server at "MY_DB_PROXY_HERE.us-east-1.rds.amazonaws.com" (SOME INTERNAL IP HERE), port 5432 failed: SSL error: certificate verify failed

update: After adding proxy endpoint resource in Terraform i have managed to connect to db proxy in command line:

ubuntu@pc:~$ psql "host=MY_DB_PROXY_HERE.us-east-1.rds.amazonaws.com port=5432 dbname=postgres user=postgres sslmode=require sslrootcert=cert.pem"
Password for user postgres:

But still getting the same SSL error in app even after it redeployment and updating value for proxy endpoint in parameter store. Any ideas where is an issue?

Done. Downloaded this: https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem our db uses Root CA rds-ca-rsa2048-g1 Updated the cert in parameter store, redeployed the app, but still getting the same error if to connect through the DB Proxy:

{"level":"error","time":1711292117599,"serviceContext":{"version":"unknown"},"context":"Nest.js","err":{"type":"Object","message":"unable to get local issuer certificate","stack":"Error: unable to get local issuer certificate\n at TLSSocket.onConnectSecure (node:_tls_wrap:1659:34)\n at TLSSocket.emit (node:events:517:28)\n at TLSSocket._finishInit (node:_tls_wrap:1070:8)\n at ssl.onhandshakedone (node:_tls_wrap:856:12)"},"data":"ExceptionHandler","message":"error"}