Certificate verify failed with new rds-ca-rsa2048-g1 CA

0

I modified my RDS instance and changed the certificate authority from rds-ca-2019 to rds-ca-rsa2048-g1 as the former will expire in 2024. However I get a SSL routines::certificate verify failed in all of my clients (php8.1-mysql, nagios check_mysql plugin). If I revert to rds-ca-2019, everything works again. The istance is a MySQL Community v.8.0.34 and I'm using the global-bundle.pem certificate. Thanks for your help.

已提問 9 個月前檢視次數 4093 次
3 個答案
2

As far as I understand, you followed the documentation for rotate your certificates. There is a link where you can find global certificate bundles and per-region.

I have several ideas what could go wrong:

  1. You have your, previously downloaded, global bundle and need to download a new one, compare them and replace if needed.
  2. You are not using your .pem file as an argument for mysql connection but using a system wide certs. In the case you need follow the instruction for your OS how to update re-generate certificates globally.
profile picture
專家
已回答 9 個月前
1
已接受的答案

I did a couple of test and I can now connect to the database server with the new CA through nagios check_mysql plugin, php8.1-mysql and mysql client. They weren't using the new pem certificate. However, the problem is still there in Laravel, but I'm now asking the Laravel community since AWS RDS is working right. Thanks for your help.

P.S: In laravel, I solved the connection problem with PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => 'false'

已回答 9 個月前
0

Thanks.

I'm using the latest global-bundle.pem certificate and I verified it comparing it with the one from your link. It's where I downloaded it.

I'm also using the .pem file as an argument in all mysql connections. Two days ago I changed my connection string from rds-combined-ca-bundle.pem to global-bundle.pem and verified that the SSL connection was working as usual.

At the moment, I have no SSL routines::certificate verify failed error in my connection and I'm using the latest global-bundle.pem certificate. It's on the server that I had to go back to rds-ca-2019 certificate authority.

已回答 9 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南