1

When updating the database to use the new CA, you get this popup:

Before scheduling the CA certificate rotation, update client applications that connect to your database to use the new CA certificate. Not doing this will cause an interruption of connectivity between your applications and your database.

Does anyone know if this is required? We didn't have to import the CA originally, so why would we have to now? If it's a matter of the new root CA not being part of the trust chain of older distros, does anyone know if Ubuntu 18.04 has the new CA in its ca-certificates package yet?

Thanks!

Improve this question

2 Answers 2

Reset to default
1

I am not completely sure that Ubuntu 18.04 will have this CA in their certificates packages because they announced this CA replacement recently.

If you are using the SSL/TLS to connect to your DB instances, then only this will be required, otherwise you can simply ignore this.

You can find the complete details of this CA certificate rotation and it's impact in the AWS blog

Improve this answer
1

As far as I read, client using that db instance has to update certificate if the client has added the db in it's truststore.

When you schedule this operation, make sure that you have updated your client-side trust store beforehand.

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.html

I don't think anything apart from this would be required. Hope this helps!!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.