Amazon RDS and Aurora certificate rotation, step by step

By Keith Motte, Topofmind.AI. Retired AWS Enterprise Support Manager (Healthcare and Life Sciences). Last updated Oct 25, 2026.

If an AWS Health email about your Amazon RDS or Aurora certificate authority landed on your desk, this page walks you through it in order. Every rule here comes from AWS documentation, numbered in the sources. You can also jump to the RDS cert update simulator for steps that fit your database.

Am I affected? Only if your apps connect over TLS and check the database's certificate. If they don't check it, the rotation doesn't affect their connection.^[5] Some drivers check by default, for example MySQL Connector/J 5.1.38 and later.^[6]

What do I do? Give every app that checks the certificate AWS's current certificate bundle, test, then switch the database to a new CA. Apps first, database second.^[2]

How long does it take? The database change is one setting, applied right away or in your maintenance window.^[2] Most of the time goes into finding which apps check the certificate. AWS says the way to tell is to look at each app's code and settings.^[4]

Two terms, explained once

TLS (the newer name for SSL) encrypts the connection between your app and the database. It also lets the app check that it's talking to the real database.

A CA (certificate authority) is the issuer that signs the database's certificate. Each app keeps a list of CAs it trusts, called a trust store. AWS publishes its CAs as a file called a certificate bundle. If an app checks certificates and the database's certificate comes from a CA that isn't in the app's trust store, the app won't connect.

The chain of trust. An app that checks certificates connects only when the database's certificate traces back to a root CA in the app's trust store.^[1]

Where things stand

rds-ca-2019 expired in 2024. In most Regions the date was Aug 22, 2024. Bahrain, China, Cape Town and Milan had other 2024 dates, and a few Regions aren't affected until 2061.^[4]
The replacements are the G1 CAs: rds-ca-rsa2048-g1, rds-ca-rsa4096-g1 and rds-ca-ecc384-g1. All three support automatic server certificate rotation. rds-ca-rsa2048-g1 is the default.^[1]
Their root certificates last decades. In AWS's bundle, they're valid until 2061 or later (RSA 2048) and 2121 or later (RSA 4096 and ECC 384), depending on the Region.^[26]
On a G1 CA, the yearly work goes away. RDS renews the database's server certificate itself, under the same root CA, so you don't download a new bundle.^[2]

How we got here.^[5]^[4]^[1]^[26]

The safe order, step by step

Update the apps before the database. AWS's rotation guide asks for this order.^[2]

Check which CA each database uses. Run this in each Region you use (or open Certificate update in the RDS console):^[14]^[2]
```
aws rds describe-db-instances --query "DBInstances[*].[DBInstanceIdentifier,Engine,EngineVersion,CACertificateIdentifier,CertificateDetails.ValidTill]" --output table
```
Then find out which apps check the certificate. Look in their connection settings for sslmode=verify-full or verify-ca (PostgreSQL), VERIFY_IDENTITY or VERIFY_CA (MySQL and MariaDB), TrustServerCertificate=False (SQL Server), or an Oracle wallet holding the RDS certificate.^[7]^[6]^[10]^[9] Two defaults catch people out: with libpq-based clients such as psql, sslmode=require also verifies if a root CA file exists,^[28] and the mariadb client verifies by default from MariaDB 11.4.^[27]
Update the clients' trust bundle. Download AWS's bundle, which works for any commercial Region. AWS GovCloud (US) has its own bundle at https://truststore.pki.us-gov-west-1.rds.amazonaws.com/global/global-bundle.pem.^[1]
```
curl -sS -o global-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
```
Add it to each app's trust settings next to what the app trusts now, rather than deleting the old certificate first; AWS says you can keep older certificates when you add the new ones.^[7] Java apps need the bundle imported into a trust store, and AWS publishes a sample keytool script for that. Some tools, such as Oracle's orapki, import only the first certificate in a PEM file, so split the bundle and add each certificate (the simulator shows how).^[30] Put only root CAs in the trust store, not intermediate certificates: intermediates can cause connection problems when RDS rotates the server certificate.^[2]^[1]
Test. On a non-production database running the same engine and version, change the CA and make sure the app reconnects.^[4]
Rotate the CA on the database. First check whether the change restarts the database: that depends on the engine version (the simulator shows the command).^[16] Then, in the console, choose Modify and pick the new CA under Connectivity. Or use the CLI, which waits for your next maintenance window:^[2]^[15]
```
aws rds modify-db-instance --db-instance-identifier mydbinstance --ca-certificate-identifier rds-ca-rsa2048-g1
```
Adding --apply-immediately applies it now, along with any other changes already waiting on the instance, so check PendingModifiedValues in describe-db-instances first.^[15]^[14] If apps already can't connect because the certificate expired, AWS says to apply the change immediately. For Aurora, run it for each DB instance in the cluster. For an RDS Multi-AZ DB cluster, use modify-db-cluster.^[2]^[3]
Verify. Run the step 1 command again: the new CA should show in the list. Then confirm each app connects. For MySQL, PostgreSQL and SQL Server, AWS's engine pages include a query that shows which sessions use TLS.^[6]^[7]^[10]

RDS cert update simulator

Answer four questions to get steps for your database and client. It runs in your browser, makes no network requests and doesn't save your answers.

How this works, and its limits

The simulator applies rules from AWS's RDS and Aurora documentation, and each result cites its sources. Client examples for drivers AWS doesn't cover come from those drivers' own docs.

It can't see your account, Region, engine version or app settings. It doesn't cover the AWS China Regions, which AWS documents separately. Restarts depend on the engine version, so it gives you the command to check instead of guessing. If your driver isn't listed, check its documentation for its certificate-verification and CA-file settings.

Special cases

RDS Proxy: it uses certificates from AWS Certificate Manager, so apps that connect through the proxy don't need updating.^[1]^[2]
Aurora Serverless v2: its instances need the rotation too.^[4]
Multi-AZ: the standby gets the new CA too, and a failover doesn't change the CA.^[5]
Go 1.15 apps: if the database was created or updated to rds-ca-2019 before July 28, 2020, AWS says to update the certificate again.^[2]
Some Regions only offer rds-ca-rsa2048-g1: Mumbai, Melbourne, Calgary, Zurich, Spain and Tel Aviv.^[1]

Why do notices like this slip through? Keith tells the story in the deadline nobody owned.

Frequently asked questions

Do I need to do anything if my apps don't use SSL/TLS?

Their connections aren't affected when apps don't use TLS or don't verify the server certificate. AWS still recommends moving to a new CA, partly because JDBC and ODBC connectors check for a valid certificate, and you need a current CA before you turn verification on. AWS's security advice is to use TLS and turn on certificate verification.

Which CA should I choose?

rds-ca-rsa2048-g1 is the default. rds-ca-rsa4096-g1 and rds-ca-ecc384-g1 are also available, except in Mumbai, Melbourne, Calgary, Zurich, Spain and Tel Aviv. All three support automatic server certificate rotation. If you pick a larger key, AWS suggests testing it in pre-production first to make sure your clients support it. To see which CAs your engine version supports, check SupportedCACertificateIdentifiers in the output of aws rds describe-db-engine-versions.

Will changing the CA restart my database?

It depends on the engine version. In the output of aws rds describe-db-engine-versions, SupportsCertificateRotationWithoutRestart is true when no restart is needed. For Oracle the flag shows false, but only the database listener restarts, so new connections can fail briefly.

What happens if I rotate the database before updating my apps?

Apps that verify the certificate won't connect until their trust store has the new root CA. For example, psql reports "SSL error: certificate verify failed". Add AWS's current bundle to those apps.

Will I have to do this again in a few years?

Not on a G1 CA. RDS renews the database's server certificate under the same root CA, so you don't download a new bundle. In AWS's bundle, the G1 root certificates are valid until 2061 or later (RSA 2048) and 2121 or later (RSA 4096 and ECC 384).

Does the simulator send my answers anywhere?

No. It runs in your browser, makes no network requests and doesn't store your answers. The page counts views with Cloudflare's cookieless Web Analytics.