aws / aws/aws-lambda-base-images

AWS RDS SSL issue: rds-ca-rsa2048-g1 rds-ca-rsa4096-g1 rds-ca-ecc384-g1 missing: unable to get local issuer certificate

Open
#123 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
No language data
Stars
777
Forks
118
PR merge metrics
No merged PRs in 30d

Description

rds-ca-rsa2048-g1 rds-ca-rsa4096-g1 rds-ca-ecc384-g1 missing inside the `lambda/python:3.11` docker image. but also, most likely others as well.

We use sequelize with Node.js to run db-migration by AWS Lambda that connects to RDS that uses latest SSL certificates (rds-ca-rsa2048-g1) in our case

Error logs:
```
Sequelize CLI [Node: 16.20.2, CLI: 6.6.2, ORM: 6.34.0]
Loaded configuration file "../../tmp/config/config.json".
ERROR: unable to get local issuer certificate
```

Workarounds:
- install CA certificates into the system manually in Dockerfile (we did not test it fully)
```
RUN curl https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem \
-o /etc/pki/ca-trust/source/anchors/us-east-1-bundle.pem \
&& update-ca-trust
```
- use CA PEM directly by DB client (sequelize in our case)

Please fix this :)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.