By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Steps for Databases (25) requiring certificate update to "rds-ca-rsa2048-g1"

0

Hi re:Post, We have a set of PostgreSQL instances that require their certificates to be updated. In looking at the update via the console process, it seems pretty straight forward but I wanted to contact re:Post and double-check/verify. Enter image description here Enter image description here q1) We need to / is recommended that we switch from using "rds-ca-2019" to "rds-ca-rsa2048-g1".
[ ] Is "rds-ca-rsa2048-g1" recommended for the Ohio region / us-east-2? In selecting the "Schedule Update" we see the following screen which recommends "rds-ca-rsa2048-g1" and that the db does not require a restart. Enter image description here q2) So if we click "Schedule" and the update for the certificate runs during the scheduled maintenance window on June 30th, is there anything else we need to do in order to have our CA SSL accept new connections via the update to "rds-ca-rsa2048-g1" ?
Or are we done? Thank you for your time and help! Best Regards, Donald

Topics
DatabaseSecurity, Identity, & Compliance
Tags
PostgreSQLAWS Certificate Manager
Language
English
profile picture
DC
asked 15 days ago716 views
1 Answer
1
Accepted Answer

Hello,

Yes, Before applying the new certificate to your DB instances, update the trust store of any clients and applications that use SSL/TLS and the server certificate for connections.

To check if the application using SSL connection, please check this documentation https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/ssl-certificate-rotation-postgresql.html#ssl-certificate-rotation-postgresql.determining-server

You can download the TLS/SSL certificates from the following link: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions

Reference:

https://aws.amazon.com/blogs/aws/rotate-your-ssl-tls-certificates-now-amazon-rds-and-amazon-aurora-expire-in-2024/

profile picture
EXPERT
Sivaraman Selvam
answered 15 days ago
profile picture
EXPERT
Gary Mclean
reviewed 15 days ago
  • DC
    15 days ago

    Hi Sivaraman, thank you for your quick reply and help. Regarding, "update the trust store of any clients and applications that use SSL/TLS and the server certificate for connections." beside the RDS instances, we have our application running on hundreds of apple I-phones. How would we get the downloaded "global-bundle.pem" to those devices? Thank you for your time and help! Best Regards, Donald

  • Gary Mclean EXPERT
    15 days ago

    Are you sure your iPhones have DIRECT access to the database? That would be very unsual for an application. Plus rds-ca-2019 is unlikely to be on your iphones anyway..

  • DC
    14 days ago

    Right, of course Gary. Yeah the iPhones would not direct access to the dbs. I'm new to the dev shop in my company and glad I asked here vs in a meeting! Thanks! Donald

Relevant content