What do I need to do to update my SSL/TLS certificate for an Amazon RDS DB instance or Aurora DB cluster?

Short Description

Amazon Relational Database Service (Amazon RDS) and Aurora SSL/TLS certificates that were created before January 14, 2020 expire on March 5, 2020. If your certificate expires, then you can lose connectivity to your RDS DB instance or Aurora DB cluster.

Resolution

You must find out if your applications use SSL/TLS to connect to Amazon RDS databases. For troubleshooting steps and more information, see Amazon RDS customers: Update your SSL/TLS certificates by March 5, 2020.

To rotate your SSL/TLS certificate, update your client application or service to include the new CA certificates in its trust store. Use the combined bundle that contains both the new and the old CA certificates. Then, update your RDS DB instances to use the new CA certificates. Before you deploy the new SSL/TLS certificate to your production environment, it's important to test the client and server. For complete instructions for updating your SSL/TLS certificates, see the following for more information:

• Rotating your SSL/TLS certificate (Amazon RDS)
• Rotating your SSL/TLS certificate (Amazon Aurora)

Related Information

Using SSL/TLS to encrypt a connection to a DB instance