Don’t be shocked in case you have seen the Certificates Replace within the Amazon Relational Database Service (Amazon RDS) console.

If you happen to use or plan to make use of Safe Sockets Layer (SSL) or Transport Layer Safety (TLS) with certificates verification to connect with your database cases of Amazon RDS for MySQL, MariaDB, SQL Server, Oracle, PostgreSQL, and Amazon Aurora, it means it’s best to rotate new certificates authority (CA) certificates in each your DB cases and utility earlier than the foundation certificates expires.

Most SSL/TLS certificates (rds-ca-2019) to your DB cases will expire in 2024 after the certificates replace in 2020. In December 2022, we launched new CA certificates which might be legitimate for 40 years (rds-ca-rsa2048-g1) and 100 years (rds-ca-rsa4096-g1 and rds-ca-ecc384-g1). So, in case you rotate your CA certificates, you don’t must do It once more for a very long time.

Here’s a record of affected Areas and their expiration dates of rds-ca-2019:

The next steps display how one can rotate your certificates to take care of connectivity out of your utility to your database cases.

Step 1 – Determine your impacted Amazon RDS sources
As I mentioned, you may determine the overall variety of affected DB cases within the Certificates replace web page of the Amazon RDS console and see your entire affected DB cases. Word: This web page solely reveals the DB cases for the present Area. In case you have DB cases in a couple of Area, examine the certificates replace web page in every Area to see all DB cases with previous SSL/TLS certificates.

You too can use AWS Command Line Interface (AWS CLI) to name describe-db-instances to seek out cases that use the expiring CA. The question will present a listing of RDS cases in your account and us-east-1 Area.

$ aws rds describe-db-instances --region us-east-1 | 
      jq -r '.DBInstances[] | 
      choose ((.CACertificateIdentifier != "rds-ca-rsa2048-g1") and 
              (.CACertificateIdentifier != "rds-ca-rsa4096-g1") and 
              (.CACertificateIdentifier != "rds-ca-ecc384-g1")) | 
               "DBInstanceIdentifier: 
              (.DBInstanceIdentifier), CACertificateIdentifier: 
              (.CACertificateIdentifier)"'

Step 2 – Updating your database shoppers and functions
Earlier than making use of the brand new certificates in your DB cases, it’s best to replace the belief retailer of any shoppers and functions that use SSL/TLS and the server certificates to attach.  There’s at present no straightforward technique out of your DB cases themselves to find out in case your functions require certificates verification as a prerequisite to attach. The one possibility right here is to examine your functions’ supply code or configuration recordsdata.

Though the DB engine-specific documentation outlines what to search for in most typical database connectivity interfaces, we strongly suggest you’re employed together with your utility builders to find out whether or not certificates verification is used and the right solution to replace the shopper functions’ SSL/TLS certificates to your particular functions.

To replace certificates to your utility, you need to use the new certificates bundle that incorporates certificates for each the previous and new CA so you may improve your utility safely and preserve connectivity throughout the transition interval.

For details about checking for SSL/TLS connections and updating functions for every DB engine, see the next subjects:

Step 3 – Check CA rotation on a non-production RDS occasion
In case you have up to date new certificates in all of your belief shops, it’s best to take a look at with a RDS occasion in non-production. Do that arrange in a improvement surroundings with the identical database engine and model as your manufacturing surroundings. This take a look at surroundings must also be deployed with the identical code and configurations as manufacturing.

To rotate a brand new certificates in your take a look at database occasion, select Modify for the DB occasion that you simply need to modify within the Amazon RDS console.

Within the Connectivity part, select rds-ca-rsa2048-g1.

Select Proceed to examine the abstract of modifications. If you wish to apply the modifications instantly, select Apply instantly.

To make use of the AWS CLI to alter the CA from rds-ca-2019 to rds-ca-rsa2048-g1 for a DB occasion, name the modify-db-instance command and specify the DB occasion identifier with the --ca-certificate-identifier possibility.

$ aws rds modify-db-instance 
          --db-instance-identifier <mydbinstance> 
          --ca-certificate-identifier rds-ca-rsa2048-g1 
          --apply-immediately

This is identical solution to rotate new certificates manually within the manufacturing database cases. Ensure that your utility reconnects with none points utilizing SSL/TLS after the rotation utilizing the belief retailer or CA certificates bundle you referenced.

If you create a brand new DB occasion, the default CA remains to be rds-ca-2019 till January 25, 2024, when it will likely be modified to rds-ca-rsa2048-g1. For setting the brand new CA to create a brand new DB occasion, you may arrange a CA override to make sure all new occasion launches use the CA of your selection.

$ aws rds modify-certificates 
          --certificate-identifier rds-ca-rsa2048-g1 
          --region <area title>

It’s best to do that in all of the Areas the place you’ve RDS DB cases.

Step 4 – Safely replace your manufacturing RDS cases
After you’ve accomplished testing in non manufacturing surroundings, you can begin the rotation of your RDS databases CA certificates in your manufacturing surroundings. You possibly can rotate your DB occasion manually as proven in Step 3. It’s price noting that lots of the fashionable engines don’t require a restart, nevertheless it’s nonetheless a good suggestion to schedule it in your upkeep window.

Within the Certificates replace web page of Step 1, select the DB occasion you need to rotate. By selecting Schedule, you may schedule the certificates rotation to your subsequent upkeep window. By selecting Apply now, you may apply the rotation instantly.

If you happen to select Schedule, you’re prompted to verify the certificates rotation. This immediate additionally states the scheduled window to your replace.

After your certificates is up to date (both instantly or throughout the upkeep window), it’s best to be certain that the database and the appliance proceed to work as anticipated.

Most of contemporary DB engines don’t require restarting your database to replace the certificates. If you happen to don’t need to restart the database only for CA replace, you need to use the --no-certificate-rotation-restart flag within the modify-db-instance command.

$ aws rds modify-db-instance 
          --db-instance-identifier <mydbinstance> 
          --ca-certificate-identifier rds-ca-rsa2048-g1 
          --no-certificate-rotation-restart

To examine in case your engine requires a restart you may examine the SupportsCertificateRotationWithoutRestart discipline within the output of the describe-db-engine-versions command. You should use this command to see which engines help rotations with out restart:

$ aws rds describe-db-engine-versions 
          --engine <engine> --include-all --region <area> | 
          jq -r '.DBEngineVersions[] | 
          "EngineName: (.Engine), 
           EngineVersion: (.EngineVersion), 
           SupportsCertificateRotationWithoutRestart: (.SupportsCertificateRotationWithoutRestart), 
           SupportedCAs: ([.SupportedCACertificateIdentifiers | 
          join(", ")])"'

Even in case you don’t use SSL/TLS for the database cases, I like to recommend to rotate your CA. You might want to make use of SSL/TLS sooner or later, and a few database connectors just like the JDBC and ODBC connectors examine for a sound cert earlier than connecting and utilizing an expired CA can stop you from doing that.

To find out about updating your certificates by modifying your DB occasion manually, automated server certificates rotation, and discovering a pattern script for importing certificates into your belief retailer, see the Amazon RDS Consumer Information or the Amazon Aurora Consumer Information.

Issues to Know
Listed below are a few necessary issues to know:

• Amazon RDS Proxy and Amazon Aurora Serverless use certificates from the AWS Certificates Supervisor (ACM). If you happen to’re utilizing Amazon RDS Proxy if you rotate your SSL/TLS certificates, you don’t must replace functions that use Amazon RDS Proxy connections. If you happen to’re utilizing Aurora Serverless, rotating your SSL/TLS certificates isn’t required.
• Now by way of January 25, 2024 – new RDS DB cases could have the rds-ca-2019 certificates by default, until you specify a unique CA through the ca-certificate-identifier possibility on the create-db-instance API; otherwise you specify a default CA override to your account like talked about within the above part. Beginning January 26, 2024 – any new database cases will default to utilizing the rds-ca-rsa2048-g1 certificates. If you want for brand new cases to make use of a unique certificates, you may specify which certificates to make use of with the AWS console or the AWS CLI. For extra data, see the create-db-instance API documentation.
• Apart from Amazon RDS for SQL Server, most fashionable RDS and Aurora engines help certificates rotation and not using a database restart within the newest variations. Name describe-db-engine-versions and examine for the response discipline SupportsCertificateRotationWithoutRestart. If this discipline is about to true, then your occasion is not going to require a database restart for CA replace. If set to false, a restart will likely be required. For extra data, see Setting the CA to your database within the AWS documentation.
• Your rotated CA indicators the DB server certificates, which is put in on every DB occasion. The DB server certificates identifies the DB occasion as a trusted server. The validity of DB server certificates is determined by the DB engine and model both 1 yr or 3 yr. In case your CA helps automated server certificates rotation, RDS mechanically handles the rotation of the DB server certificates too. For extra details about DB server certificates rotation, see Computerized server certificates rotation within the AWS documentation.
• You possibly can select to make use of the 40-year validity certificates (rds-ca-rsa2048-g1) or the 100-year certificates. The expiring CA utilized by your RDS occasion makes use of the RSA2048 key algorithm and SHA256 signing algorithm. The rds-ca-rsa2048-g1 makes use of the very same configuration and subsequently is finest suited to compatibility. The 100-year certificates (rds-ca-rsa4096-g1 andrds-ca-ecc384-g1) use safer encryption schemes than rds-ca-rsa2048-g1. If you wish to use them, it’s best to take a look at properly in pre-production environments to double-check that your database shopper and server help the required encryption schemes in your Area.

Simply Do It Now!
Even in case you have one yr left till your certificates expires, it’s best to begin planning together with your group. Updating SSL/TLS certificates could require restart your DB occasion earlier than the expiration date. We strongly suggest that you simply schedule your functions to be up to date earlier than the expiry date and run exams on a staging or pre-production database surroundings earlier than finishing these steps in a manufacturing environments. To study extra about updating SSL/TLS certificates, see Amazon RDS Consumer Information and Amazon Aurora Consumer Information.

If you happen to don’t use SSL/TLS connections, please notice that database safety finest practices are to make use of SSL/TLS connectivity and to request certificates verification as a part of the connection authentication course of. To study extra about utilizing SSL/TLS to encrypt a connection to your DB occasion, see Amazon RDS Consumer Information and Amazon Aurora Consumer Information.

In case you have questions or points, contact your regular AWS Assist by your Assist plan.

— Channy