AWS: RDS Certificate Authority SSL certificate upgrade
Tags: aws, security, cloud
Published: 2019-11-22 11:50:37

---
title: AWS: RDS Certificate Authority SSL certificate upgrade
published: true
date: 2019-11-22 09:28:09 UTC
tags: aws,security,cloud
canonical_url: https://rtfm.co.ua/en/aws-rds-certificate-authority-ssl-certificate-upgrade/
---

![](https://rtfm.co.ua/wp-content/uploads/2014/11/aws-logo-square-02-e1417012834176-1.png)We started receiving emails from AWS with notifications to update RDS Certificate Authority certificates.

It’s time to do it, so let’s start from our Dev, then will repeat on Staging and Production environments.

W eare using common AWS RDS MariaDB instances, and the upgrade documentation is available [here>>>](https://docs.aws.amazon.com/en_us/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html).

The process itself is really simple and will take just a couple of minutes (although – will see, how it will go with RDS Slaves enabled, which we have on Stage and Prod).

In our case, we are not using SSL for communication between our backend applications and RDS databases as they are in VPCs and we have VPC peering enabled between them so all traffic are passed via private networks. You can check the [OpenVPN: OpenVPN Access Server set up and AWS VPC peering configuration post for](https://rtfm.co.ua/en/openvpn-openvpn-access-server-set-up-and-aws-vpc-peering-configuration/) example of such setup.

But anyway – need to update the CA.

Also, take a look at [MySQL/MariaDB: настройка SSL](https://rtfm.co.ua/mysql-mariadb-nastrojka-ssl/) post about MySQL SSL configuration (_Rus only_).

The one frustrating thing in the CA upgrade is the fact that:

> This operation reboots your DB instance. By default, this operation is scheduled to run during your next maintenance window. Alternatively, you can choose to run it immediately.

While we have data continuously updated, thus we will have to stop our backend applications during this upgrade on Production.

### RDS Certificate Authority upgrade

The documentation mentioned above describes three steps:

1. _Download the new SSL/TLS certificate from Using SSL/TLS to Encrypt a Connection to a DB Instance_ // not in our case, as the backend does not use SSL
2. _Update your database applications to use the new SSL/TLS certificate_ // not in our case, as the backend does not use SSL
3. _Modify the DB instance to change the CA from  **rds-ca-2015**  to  **rds-ca-2019**_ // here is hat will have to do

And the next process is very simple.

First, let’s do it via the AWS Console, and then will do a roll-back using AWS CLI.

Go to AWS RDS, chose an instance, check the certificate currently in use:

[![](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_094006.png "AWS: RDS обновление Certificate Authority SSL сертификата")](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_094006.png)

Click on the _Modify_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_101115.png "AWS: RDS обновление Certificate Authority SSL сертификата")](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_101115.png)

Chose a new certificate:

[![](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_094105.png "AWS: RDS обновление Certificate Authority SSL сертификата")](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_094105.png)

One more warning:

> Before scheduling the CA certificate rotation, update client applications that connect to your database to use the new CA certificate. Not doing this will cause an interruption of connectivity between your applications and your database. [Get new CA certificates.](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html)

Okay, not our case, but be aware.

Press _Continue_, then _Apply immediately_ and _Modify DB __Instance_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_094503.png "AWS: RDS обновление Certificate Authority SSL сертификата")](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_094503.png)

And one more notification about the following reboot:

> Note that rotating the SSL certificate on a database instance will initiate a reboot operation so that the certificate takes effect. The reboot operation [typically](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html) takes less than two minutes to complete.

After reboot – check the new certificate installed:

[![](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_094821.png "AWS: RDS обновление Certificate Authority SSL сертификата")](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_094821.png)_rds-ca-**2019**_ – great.

### Rollback with AWS CLI

And now let’s do a roll-back, just to test it in case if, for example, your backend stopped working after CA upgrade if you are using SSL for connections.

Let’s do it with AWS CLI now and in the same way, you can do CA upgrade.

The rollback process also very simple – all the same steps, just using the _rds-ca-**2015**_ certificate instead of the _rds-ca-**2019**_:

```
[setevoy@setevoy-arch-work ~]  $ aws --profile bm-backend --region us-east-2 rds modify-db-instance --db-instance-identifier mobilebackend-dev-db1-master-rds --ca-certificate-identifier rds-ca-2015 --apply-immediately
```

Pay attention to the `--apply-immediately` option used here – maybe you’ll need to apply changes and perform reboot in another time.

Wait for the reboot to be finished:

[![](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_095718.png "AWS: RDS обновление Certificate Authority SSL сертификата")](https://rtfm.co.ua/wp-content/uploads/2019/11/Screenshot_20191122_095718.png)

Check currently used certificate:

```
[setevoy@setevoy-arch-work ~]  $  aws --profile bm-backend --region us-east-2 rds describe-db-instances --db-instance-identifier mobilebackend-dev-db1-master-rds --query 'DBInstances[\*].CACertificateIdentifier' --output text

rds-ca-2015
```

_rds-ca-**2015**_ – done.


### Similar posts

- <small>10/18/2019</small> [AWS: Redshift – quick start and SQL-workbench connection config](https://rtfm.co.ua/en/aws-redshift-quick-start-and-sql-workbench-connection-config/) 
- <small>05/24/2019</small> [OpenVPN: Let’s Encrypt DNS verification on AWS Route53 and OpenVPN Access Server SSL certificate auto update](https://rtfm.co.ua/en/openvpn-lets-encrypt-dns-verification-on-aws-route53-and-openvpn-access-server-ssl-certificate-auto-update/)
- <small>02/26/2019</small> [OpenVPN: SSL and hostname configuration](https://rtfm.co.ua/en/openvpn-ssl-and-hostname-configuration/)