Renewing AWS RDS CA Certificates Ahead of Expiration

AWS RDS's CA certificate rds-ca-2019 is set to expire in August 2024, and replacement is recommended via Personal Health Dashboard and Databases requiring certificate update notifications.

During the SSL/TLS handshake, the client verifies the validity of the server certificate, so if the certificate expires, connection errors occur. Therefore, you must replace it with a new CA before expiration.

The new certificates available as replacements are rds-ca-rsa2048-g1, rds-ca-rsa4096-g1, and rds-ca-ecc384-g1, and these three types will support automatic certificate rotation in the future. In particular, rds-ca-rsa4096-g1 and rds-ca-ecc384-g1 expire on May 21, 2121, and rds-ca-rsa2048-g1 expires on May 21, 2061.

Before updating, you need to check whether a restart is required for each DB Engine. Engines and versions where the SupportsCertificateRotationWithoutRestart value is false in describe-db-engine-versions will restart when the certificate is renewed, and if the value doesn't appear or shows as null, you should upgrade awscli to the latest version.

• You can query restart targets across all engines
• You can filter to check specific engines only
• Newer versions are more likely to apply without a restart

The actual renewal is performed via Modify DB instance in the RDS console. Select the new CA in the certificate selection field in the middle, and to apply it immediately, select Apply immediately and then apply.

According to test results, for RDS for MySQL 5.7 and Aurora MySQL 2, although it varies depending on instance class and workload, it generally took 2-3 minutes based on Logs & events, and the actual connection-dropping restart took about 8-20 seconds. There was no significant difference based on whether backups were enabled or on Multi-AZ status.

However, for engine versions where the Writer restarts in Aurora MySQL 2.10 or below, renewing the Writer's certificate may also cause the Reader to restart together. Therefore, before large-scale application, it is safer to also review service characteristics, inspection methods, and whether to use an Out-Of-Place transition such as blue/green.