Whats the difference between AWS RDS certificate bundle URLs?

user_227821 0
Viewed 256

I found https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem in a legacy repository and came to the conclusion this contains RDS certificates as described here for Lightsail. On the contrary, the RDS documentation proclaims to use https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem. What is the difference of the two URLs? Is the first just the "older", "legacy" version?

amazon-rds amazon-web-services ssl
1 Answers

I have been recently faced with the same issue, and although I did not find an official answer from AWS in the documentation, I think the right one nowadays is the one hosted in truststore.pki.rds.amazonaws.com:

  • The RDS documentation just mentions the ones hosted on truststore.pki...
  • You can still download both files and check their certificates with openssl: 
    openssl crl2pkcs7 -nocrl -certfile global-bundle.pem | openssl pkcs7 -print_certs -text -noout | less

openssl crl2pkcs7 -nocrl -certfile rds-combined-ca-bundle.pem | openssl pkcs7 -print_certs -text -noout | less
  • You will then see that rds-combined-ca-bundle.pem contains a subset (~30) of the certificates included in global-bundle.pem (~100). More regions are included in the latter, and multiple CA variants for RSA vs elliptic curve.

Long story short, I think you are right and the one on s3.amazonaws.com is a legacy file just kept not to break existing flows, probably done at the time of the 2015 to 2019 CAs migration.

user_42287980
Related