Amazon RDS Certificate and Certificate Authority
Description
Information regarding the Amazon RDS certificate rotation (August 2024) and the required certificate authority files for Alpha Anywhere connectivity.
Discussion
In August 2024, Amazon replaced the certificates and certificate authority files used for Amazon RDS as the previous `rds-ca-2019` certificates expired.
To maintain connectivity to Amazon RDS databases using TLS/SSL, your application must use the new certificate authority files provided by Amazon.
Required Action
If you are connecting to an Amazon RDS database using TLS/SSL, you must use the new certificate authority file. The older `rds-ca-2019` certificates are no longer valid.
If you have installed Build 8862 (or newer), Alpha Anywhere automatically uses the correct file.
If applications other than Alpha Anywhere are accessing your Amazon RDS database, please verify that they have also been updated to use the new certificate bundles.
How Alpha Anywhere Handles Certificates
When you select TLS/SSL on the connection string dialog, Alpha Anywhere automatically handles the certificate authority file.
In builds prior to 8862, Alpha Anywhere used `rds-combined-ca-bundle.pem`. Beginning with Build 8862, Alpha Anywhere uses global-bundle-2023-09.pem (or newer) which contains the required long-term certificates (valid for 40+ years).
File Locations
The certificate authority files are located in the following folder within the Alpha Anywhere Application Server installation:
redist\SQLDatabases\Certificates\AmazonRDS
This folder contains:
- global-bundle.pem (The official current bundle)
- global-bundle-2023-09.pem (The specific dated bundle included in this build)
- rds-combined-ca-bundle.pem (The legacy bundle, kept for backward compatibility but no longer used for new connections)
Updating Older Builds (Manual Update)
If you must run an older build of Alpha Anywhere (pre-8862), you can manually update the certificate files to restore connectivity.
Download the latest global-bundle.pem directly from Amazon: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
Navigate to the redist\SQLDatabases\Certificates\AmazonRDS folder on your server.
Rename the downloaded file to rds-combined-ca-bundle.pem and overwrite the existing file in that folder.
Repeat this process in the binary folder for Alpha Anywhere Developer Edition if you need to test locally.
Alpha Cloud
All current Alpha Cloud deployments have been automatically updated to support the new certificates. No action is required for applications running on the latest builds.
Amazon Documentation
For technical details on the certificate rotation and the validity of the new bundles, refer to the Amazon documentation: