RDS Certificate Rotation Failing - "Certificate not found: rds-ca-2019" Error

Question

I'm trying to rotate the SSL/TLS certificate on my RDS PostgreSQL instance from the expired rds-ca-2019 to rds-ca-rsa2048-g1, but I'm getting a "Certificate not found: rds-ca-2019" error.

Environment:
Region: eu-central-1
Engine: PostgreSQL 13.20
Current CA Certificate: rds-ca-2019 (expired August 22, 2024)

Trying to run:
```
aws rds modify-db-instance \
  --db-instance-identifier REDACTED \
  --ca-certificate-identifier rds-ca-rsa2048-g1 \
  --apply-immediately
```
Error:
```
An error occurred (CertificateNotFound) when calling the ModifyDBInstance operation: Certificate not found: rds-ca-2019
```

Getting the same over the UI. No pending maintenance actions:
```
 ~  %  aws rds describe-pending-maintenance-actions \                                                                                      
  --resource-identifier arn:aws:rds:eu-central-1:REDACTED:db:REDACTED
{
    "PendingMaintenanceActions": []
}
```

I can imagine what's happening here, where the issue stems from the expired `rds-ca-2019` no longer being recognized by the system. Is there a workaround or alternative approach to successfully rotate the certificate?

re:Post Agent · Answer

The error you're encountering is a known issue when trying to rotate certificates on RDS instances. Based on similar cases, there are a couple of approaches you can try:

1. When rotating the certificate, make sure you're not trying to change other parameters at the same time. One user found that when they were attempting to update both the certificate authority and the minor version simultaneously, they received this error. Try modifying only the certificate authority without changing any other parameters:

```
aws rds modify-db-instance \
--db-instance-identifier REDACTED \
--ca-certificate-identifier rds-ca-rsa2048-g1 \
--apply-immediately
```

2. If you're still encountering issues with the AWS CLI, you can try using the AWS Management Console to perform the certificate rotation. Navigate to your RDS instance, select "Modify," and update only the CA certificate to one of the new options (rds-ca-rsa2048-g1, rds-ca-rsa4096-g1, or rds-ca-ecc384-g1).

Remember that before updating your DB instances to use the new CA certificate, you should update any clients or applications that connect to your RDS databases to ensure they can recognize the new certificate.

If these approaches don't work, you may need to contact AWS Support for further assistance, as the expired certificate situation might require special handling.  
**Sources**  
[RDS Certificate Authority EOL update not working | AWS re:Post](https://repost.aws/questions/QU-HZyY--mRv-VckuOW48Fzw/rds-certificate-authority-eol-update-not-working)  
[Certificate issue in RDS "Preview environment" | AWS re:Post](https://repost.aws/questions/QUgYs3Ic8nT3qb_JmOJfq1xA/certificate-issue-in-rds-preview-environment)  
[Rotating your SSL/TLS certificate - Amazon Aurora](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.html)

Shahed Kazi (@shajam) · Answer

Certificate `rds-ca-2019` is no longer available in ca-central-1. I suspect AWS has to perform additional maintenance before your change can be made even through it's not appearing in maintenance window. If you have AWS Support plan, best to raise a ticket there.

RDS Certificate Rotation Failing - "Certificate not found: rds-ca-2019" Error

Add your answer

Relevant content