Using SSL/TLS to encrypt a connection to a DB cluster - Amazon Aurora
Certificate bundles for AWS RegionsAWS GovCloud (US) certificates

Using SSL/TLS to encrypt a connection to a DB cluster

You can use Secure Socket Layer (SSL) or Transport Layer Security (TLS) from your application to encrypt a connection to a DB cluster running Aurora MySQL or Aurora PostgreSQL.

SSL/TLS connections provide one layer of security by encrypting data that moves between your client and a DB cluster. Using a server certificate provides an extra layer of security by validating that the connection is being made to an Amazon Aurora DB cluster. It does so by checking the server certificate that is automatically installed on all DB clusters that you provision.

Each DB engine has its own process for implementing SSL/TLS. To learn how to implement SSL/TLS for your DB cluster, use the link following that corresponds to your DB engine:

Note

All certificates are only available for download using SSL/TLS connections.

To get a certificate bundle that contains both the intermediate and root certificates for all AWS Regions, download from https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem.

If your application is on Microsoft Windows and requires a PKCS7 file, you can download the PKCS7 certificate bundle. This bundle contains both the intermediate and root certificates at https://truststore.pki.rds.amazonaws.com/global/global-bundle.p7b.

Note

Amazon RDS Proxy and Aurora Serverless use certificates from the AWS Certificate Manager (ACM). If you are using RDS Proxy, you don't need to download Amazon RDS certificates or update applications that use RDS Proxy connections. For more information about using TLS/SSL with RDS Proxy, see Using TLS/SSL with RDS Proxy.

If you are Aurora Serverless, downloading Amazon RDS certificates isn't required. For more information about using TLS/SSL with Aurora Serverless, see Using TLS/SSL with Aurora Serverless v1.

Certificate bundles for AWS Regions

To get a certificate bundle that contains both the intermediate and root certificates for an AWS Region, download from the link for the AWS Region in the following table.

AWS Region Certificate bundle (PEM) Certificate bundle (PKCS7)
US East (N. Virginia) us-east-1-bundle.pem us-east-1-bundle.p7b
US East (Ohio) us-east-2-bundle.pem us-east-2-bundle.p7b
US West (N. California) us-west-1-bundle.pem us-west-1-bundle.p7b
US West (Oregon) us-west-2-bundle.pem us-west-2-bundle.p7b
Africa (Cape Town) af-south-1-bundle.pem af-south-1-bundle.p7b
Asia Pacific (Hong Kong) ap-east-1-bundle.pem ap-east-1-bundle.p7b
Asia Pacific (Mumbai) ap-south-1-bundle.pem ap-south-1-bundle.p7b
Asia Pacific (Osaka) ap-northeast-3-bundle.pem ap-northeast-3-bundle.p7b
Asia Pacific (Tokyo) ap-northeast-1-bundle.pem ap-northeast-1-bundle.p7b
Asia Pacific (Seoul) ap-northeast-2-bundle.pem ap-northeast-2-bundle.p7b
Asia Pacific (Singapore) ap-southeast-1-bundle.pem ap-southeast-1-bundle.p7b
Asia Pacific (Sydney) ap-southeast-2-bundle.pem ap-southeast-2-bundle.p7b
Canada (Central) ca-central-1-bundle.pem ca-central-1-bundle.p7b
Europe (Frankfurt) eu-central-1-bundle.pem eu-central-1-bundle.p7b
Europe (Ireland) eu-west-1-bundle.pem eu-west-1-bundle.p7b
Europe (London) eu-west-2-bundle.pem eu-west-2-bundle.p7b
Europe (Milan) eu-south-1-bundle.pem eu-south-1-bundle.p7b
Europe (Paris) eu-west-3-bundle.pem eu-west-3-bundle.p7b
Europe (Stockholm) eu-north-1-bundle.pem eu-north-1-bundle.p7b
Middle East (Bahrain) me-south-1-bundle.pem me-south-1-bundle.p7b
South America (São Paulo) sa-east-1-bundle.pem sa-east-1-bundle.p7b

AWS GovCloud (US) certificates

To get a certificate bundle that contains both the intermediate and root certificates for the AWS GovCloud (US) Regions, download from https://truststore.pki.us-gov-west-1.rds.amazonaws.com/global/global-bundle.pem.

If your application is on Microsoft Windows and requires a PKCS7 file, you can download the PKCS7 certificate bundle. This bundle contains both the intermediate and root certificates at https://truststore.pki.us-gov-west-1.rds.amazonaws.com/global/global-bundle.p7b.

To get a certificate bundle that contains both the intermediate and root certificates for an AWS GovCloud (US) Region, download from the link for the AWS GovCloud (US) Region in the following table.

AWS GovCloud (US) Region Certificate bundle (PEM) Certificate bundle (PKCS7)
AWS GovCloud (US-East) us-gov-east-1-bundle.pem us-gov-east-1-bundle.p7b
AWS GovCloud (US-West) us-gov-west-1-bundle.pem us-gov-west-1-bundle.p7b