Answers: <p>As far as I read, client using that db instance has to update certificate if the client has added the db in it's truststore.</p>
  
  <p><strong><em>When you schedule this operation, make sure that you have updated your client-side trust store beforehand.</em></strong> </p>
  
  <p><strong><a href="https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.html</a></strong></p>
  
  <p>I don't think anything apart from this would be required. Hope this helps!!</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-01-19T05:27:26.917Z
Answers: 2020-01-19T05:27:26.917Z
Answers: nsm10
Answers: <p>I am not completely sure that Ubuntu 18.04 will have this CA in their certificates packages because they announced this CA replacement recently. </p>
  
  <p>If you are using the SSL/TLS to connect to your DB instances, then only this will be required, otherwise you can simply ignore this. </p>
  
  <p>You can find the complete details of this CA certificate rotation and it's impact in the AWS <a href="https://aws.amazon.com/blogs/database/amazon-rds-customers-update-your-ssl-tls-certificates-by-february-5-2020/" rel="nofollow noreferrer">blog</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-01-16T19:12:05.110Z
Answers: 2020-01-16T19:12:05.110Z
Answers: Samit
Body: <p>When updating the database to use the new CA, you get this popup:</p>
  
  <blockquote>
    <p>Before scheduling the CA certificate rotation, update client
    applications that connect to your database to use the new CA
    certificate. Not doing this will cause an interruption of connectivity
    between your applications and your database.</p>
  </blockquote>
  
  <p>Does anyone know if this is required? We didn't have to import the CA originally, so why would we have to now? If it's a matter of the new root CA not being part of the trust chain of older distros, does anyone know if Ubuntu 18.04 has the new CA in its ca-certificates package yet?</p>
  
  <p>Thanks!</p>
  
Tags: <amazon-rds>
Title: Question about the new AWS RDS CA
UserDisplayName: Soviero
ThreadText: # Question about the new AWS RDS CA
  
  (Asked by: username_0 on 2020-01-15)
  
  When updating the database to use the new CA, you get this popup:
  
  > Before scheduling the CA certificate rotation, update client
  > applications that connect to your database to use the new CA
  > certificate. Not doing this will cause an interruption of connectivity
  > between your applications and your database.
  
  Does anyone know if this is required? We didn't have to import the CA originally, so why would we have to now? If it's a matter of the new root CA not being part of the trust chain of older distros, does anyone know if Ubuntu 18.04 has the new CA in its ca-certificates package yet?
  
  Thanks!
  
  **Tags:** amazon-rds
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2020-01-19. Score: 1
  
  As far as I read, client using that db instance has to update certificate if the client has added the db in it's truststore.
  
  ***When you schedule this operation, make sure that you have updated your client-side trust store beforehand.***
  
  **<https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.html>**
  
  I don't think anything apart from this would be required. Hope this helps!!
  
  
  ---
  
  ### Answer by username_2 on 2020-01-16. Score: 1
  
  I am not completely sure that Ubuntu 18.04 will have this CA in their certificates packages because they announced this CA replacement recently.
  
  If you are using the SSL/TLS to connect to your DB instances, then only this will be required, otherwise you can simply ignore this.
  
  You can find the complete details of this CA certificate rotation and it's impact in the AWS [blog](https://aws.amazon.com/blogs/database/amazon-rds-customers-update-your-ssl-tls-certificates-by-february-5-2020/)
  
  
  ---
  
  