Connect to Postgres DB in AWS using IAM Authentication with SSL

Question

I have an RDS instance running Postgres which has IAM Authentication enabled. I can successfully connect using an IAM token via powershell, but I'm having trouble with certificates when trying to connect using the Npgsql library with C# (targeting .Net Core 3.1) from Visual Studio 2019 Version 16.8.5 (on .Net Framework 4.8).

Note, I've been referencing this AWS page, which gives download links for the certificates. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html

I've also been referencing this page to guide me through getting this set up. https://aws.amazon.com/premiumsupport/knowledge-center/rds-postgresql-connect-using-iam/

I can connect with PowerShell, using:

$ENV:RDSHOST="my-postgres-instance.eu-west-1.rds.amazonaws.com"
$ENV:PGPASSWORD="$(aws rds generate-db-auth-token --hostname $ENV:RDSHOST --port 5432 --region eu-west-1 --username my_db_user)"
psql -h $ENV:RDSHOST -p 5432 "sslmode=verify-full sslrootcert=rds-ca-2019-root.pem dbname=my_db user=my_db_user password=$ENV:PGPASSWORD"

However when I try to open a connection with C# using the Npgsql library with the code below, I get an exception:

var host = "my-postgres-instance.eu-west-1.rds.amazonaws.com";
var port = 5432;
var user = "my_db_user";

var token = RDSAuthTokenGenerator.GenerateAuthToken(RegionEndpoint.EUWest1, host, port, user);

var builder = new NpgsqlConnectionStringBuilder
{
    Host = host,
    Port = port,
    Database = "my_db",
    Username = user,
    Password = token,
    SslMode = SslMode.Require,
    RootCertificate = @"C:\Path\To\Cert\rds-combined-ca-bundle.pem",
};

using (var conn = new NpgsqlConnection(builder.ConnectionString))
{
    conn.Open();
}

Npgsql.NpgsqlException: 'Exception while performing SSL handshake
AuthenticationException: The remote certificate is invalid according to the validation procedure.

It's worth noting that I can connect setting TrustServerCertificate = true, however as I understand it, this is masking the problem and reducing security, and is not advisable.

The AWS page linked above mentions:

If your application is on Microsoft Windows and requires a PKCS7 file, you can download the PKCS7 certificate bundle. This bundle contains both the intermediate and root certificates at https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.p7b.

I've tried specifying this p7b file as the NpgsqlConnectionStringBuilder.ClientCertificate, but this causes a different exception when opening the connection:

Internal.Cryptography.CryptoThrowHelper.WindowsCryptographicException: 'Cannot find the original signer.'

Anyone able to help me understand how to connect? It's worth noting that I'm not very familiar with detting up SSL connections or dealing with certificates, so bear that in mind.

Connect to Postgres DB in AWS using IAM Authentication with SSL

0 Answers