Using SSL to Encrypt a Connection to a DB Instance

You can use SSL from your application to encrypt a connection to a DB instance running MySQL, MariaDB, SQL Server, Oracle, or PostgreSQL. Each DB engine has its own process for implementing SSL. To learn how to implement SSL for your DB instance, use the link following that corresponds to your DB engine:

A root certificate that works for all regions can be downloaded at https://s3.amazonaws.com/rds-downloads/rds-ca-2015-root.pem. It is the trusted root entity and should work in most cases but might fail if your application doesn't accept certificate chains. If your application doesn't accept certificate chains, download the AWS Region–specific certificate from the list of intermediate certificates found later in this section.

Note

All certificates are only available for download using SSL connections.

A certificate bundle that contains both the old and new root certificates can be downloaded at https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem .

If your application is on the Microsoft Windows platform and requires a PKCS7 file, you can download the PKCS7 certificate bundle that contains both the old and new certificates at https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.p7b .

Intermediate Certificates

You might need to use an intermediate certificate to connect to your region. For example, you must use an intermediate certificate to connect to the AWS GovCloud (US) region using SSL. If you need an intermediate certificate for a particular AWS Region, download the certificate from the following list:

Asia Pacific (Mumbai)

Asia Pacific (Tokyo)

Asia Pacific (Seoul)

Asia Pacific (Osaka-Local)

Asia Pacific (Singapore)

Asia Pacific (Sydney)