How to re-rotate AWS RDS certificates for golang 1.15 compatibility

user_973737 0
Viewed 343

I am attempting to resolve the issue described here: https://github.com/golang/go/issues/39568 and here: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html, where AWS requires customers to re-rotate RDS certificates (rds-ca-2019) to make them compatible with golang 1.15

If you are using a Go version 1.15 application with a DB instance that was created or updated to the rds-ca-2019 certificate prior to July 28, 2020, you must update the certificate again. Run the modify-db-instance command shown in the AWS CLI section using rds-ca-2019 as the CA certificate identifier. In this case, it isn't possible to update the certificate using the AWS Management Console. If you created your DB instance or updated its certificate after July 28, 2020, no action is required. For more information, see Go GitHub issue #39568.

To be clear, my RDS servers are already using rds-ca-2019, but I rotated them before July 28, 2020. When I check the certs using openssl s_client -starttls mysql [hostname], I see a cert without a SAN.

I am issuing this command at the cli, but nothing happens, no pending maintenance is created, the server is not restarted, and the cert continues to be the old one without the SAN.

aws rds modify-db-instance --db-instance-identifier [db-ident] --ca-certificate-identifier rds-ca-2019 --apply-immediately --certificate-rotation-restart

I have tried all the permutations with and without the --apply-immediately and --certificate-rotation-restart flags.

What am I doing wrong here?

amazon-rds go amazon-web-services ssl
1 Answers

This works:

aws rds modify-db-instance --db-instance-identifier [db-ident] --ca-certificate-identifier rds-ca-2019 --apply-immediately

If you sit in the RDS console for a minute, the reboot begins ~10 seconds after issuing the command.

When the instance comes back up, it is using a new cert with a SAN, which can be verified with:

openssl s_client -starttls mysql [db-hostname] < /dev/null 2> /dev/null | openssl x509 -noout -text | grep "Subject Alternative Name"

I can't explain why it wasn't working for me at the time I posted the question, but I'm perfectly willing to say that it was more likely my fault than AWS. ;)

user_9737370
Related