Articles

Rotate RDS SSL Certificates: Avoid Connection Failures (2026)

April 18, 2026 6 min read

Rotating your RDS SSL certificates is crucial to prevent unexpected connection failures, as certificates have a finite lifespan.

Let’s see how this plays out in a real scenario. Imagine a web application that relies on an RDS database. If the database’s SSL certificate expires and isn’t updated, the application’s connection attempts will start failing with an SSL handshake error. This isn’t because the database is down, but because the client (your application) no longer trusts the server’s (RDS) identity due to the expired certificate.

Here’s a breakdown of how to manage this process effectively:

Understanding the Certificate Rotation Lifecycle

RDS certificates are managed by AWS. When a certificate is nearing expiration, AWS typically issues a new one and makes it available for your RDS instances. You then need to apply this new certificate to your instance. The process involves a few key stages:

  1. Notification: AWS will notify you well in advance of the certificate expiration. These notifications are usually sent via email to your AWS account’s root user and any configured SNS topics.
  2. New Certificate Availability: AWS makes the new CA certificate bundle available. You can find the latest CA bundle on the AWS RDS documentation page.
  3. Applying the New Certificate: This is the manual step where you initiate the rotation on your RDS instance.

Practical Steps for Rotation

The primary mechanism for rotating RDS SSL certificates is through the AWS Management Console or the AWS CLI.

1. Identify the Current and Upcoming Certificates

Before you start, it’s good practice to know which certificate your RDS instance is currently using and what the new one will be.

  • Via AWS Console: Navigate to your RDS instances, select your instance, and go to the "Connectivity & security" tab. Under "Encryption," you’ll see the "CA certificate" currently in use. You can also find information about upcoming certificate expirations in the "Notifications" section.
  • Via AWS CLI:
    aws rds describe-db-instances --db-instance-identifier your-db-instance-id --query "DBInstances[*].CACertificateIdentifier" --output text
    This command will output the CACertificateIdentifier for your specified instance.

2. Download the Latest CA Certificate Bundle

You’ll need the latest CA certificate bundle from AWS. This bundle contains the public keys for the Certificate Authorities that AWS uses to issue certificates for RDS.

  • Find the bundle: Search for "RDS CA Certificates" on the AWS documentation website. You’ll find a page listing the available CA certificates and their corresponding download links.
  • Example: As of late 2023/early 2024, you might be looking for certificates like rds-ca-2019. Download the .pem file for the latest one.

3. Update Your RDS Instance’s CA Certificate

This is the core step. You’ll initiate a modification on your RDS instance to switch to the new CA certificate.

  • Via AWS Console:
    1. Go to the RDS console.
    2. Select your database instance.
    3. Click "Modify."
    4. Scroll down to the "Encryption" section.
    5. For "CA certificate," select the new certificate from the dropdown list (e.g., rds-ca-2019).
    6. Scroll to the bottom and click "Continue."
    7. Review the changes and choose when to apply them. For immediate application, select "Apply during the next scheduled maintenance window" and check the "Apply immediately" box. Note: Applying immediately will cause a brief database reboot.
  • Via AWS CLI:
    aws rds modify-db-instance \
    --db-instance-identifier your-db-instance-id \
    --ca-certificate-identifier rds-ca-2019 \
    --apply-immediately
    Replace your-db-instance-id with your actual instance identifier and rds-ca-2019 with the identifier of the new CA certificate. The --apply-immediately flag will cause a reboot. If you omit it, the change will be applied during the next maintenance window.

Important Considerations During Rotation:

  • Downtime: Applying a new CA certificate to an RDS instance requires a reboot. This reboot typically takes a few minutes. Plan this during a maintenance window or a period of low activity if possible.
  • Client-Side Updates: This is the most critical part often overlooked. After you update the RDS instance’s certificate, your clients (applications, tools, users) that connect to the database will also need to trust the new CA. If your clients are configured to use the default system trust store or have explicitly configured the old RDS CA certificate, they will start failing connections after the RDS instance reboots with the new certificate.
    • How to update clients: This involves updating the trust store on the servers running your applications or the client machines. For example, if you’re using Java applications, you might need to update the cacerts file in your Java Runtime Environment. If you’re using specific SSL configurations in your application code or ORM, you’ll need to update those configurations to point to the new CA certificate bundle.
    • Best Practice: For critical applications, it’s often recommended to update client trust stores before initiating the RDS instance certificate rotation. This way, clients will already trust the new certificate when the instance reboots.
  • Testing: After the rotation, thoroughly test all applications and services that connect to the RDS instance to ensure they are functioning correctly.

4. Update Application/Client Trust Stores

As mentioned above, this is paramount. If your applications or tools explicitly trust the old CA, they will fail.

  • Example for Java: You might use keytool to import the new CA certificate into your JRE’s trust store:
    keytool -importcert -alias rds-ca-2019 -keystore /path/to/jre/lib/security/cacerts -file rds-ca-2019-root.pem
# You will be prompted for the keystore password, which is typically 'changeit' by default.
    Ensure your application is using this JRE.

Avoiding Connection Failures: The Dual Trust Approach

A more robust strategy to avoid connection failures during rotation is to ensure your clients can trust both the old and the new CA certificates for a period.

  1. Update client trust stores first: Add the new CA certificate to your clients’ trust stores before you initiate the RDS instance modification.
  2. Modify RDS instance: Apply the new CA certificate to your RDS instance. It will reboot. During this reboot, clients might lose connection briefly.
  3. Clients reconnect: Once the instance is back up with the new certificate, clients that have been updated to trust the new CA will connect successfully.
  4. Remove old CA: After a suitable grace period (e.g., a few days or weeks) and confirmation that all clients are connecting successfully, you can then remove the old CA certificate from your client trust stores.

This phased approach minimizes the window of potential connection disruption.

The next challenge you’ll likely face is managing encryption for data at rest and in transit more broadly, beyond just the certificate rotation.

Want structured learning?

Take the full Rds course →