node-mysql2 icon indicating copy to clipboard operation
node-mysql2 copied to clipboard

Update TLS certs for Amazon RDS instances

Open ls-pieter-vanisacker opened this issue 2 years ago • 1 comments

It seems like the current version, 3.5.1 is unable to connect successfully to RDS instances using the rds-ca-rsa2048-g1 certificate authority.

Example code:

// get the client
const mysql = require('mysql2');

// create the connection to database
const connection = mysql.createConnection({
  host: 'xyz.c8dqrcnbng7v.eu-west-1.rds.amazonaws.com',
  port: 3306,
  user: 'abc',
  password: 'abc',
  database: 'information_schema',
  ssl: "Amazon RDS"
});

// simple query
connection.query(
  'show tables;',
  function(err, results, fields) {
    console.log(results); // results contains rows returned by server
    console.log(fields); // fields contains extra meta data about results, if available
  }
);

Throws the following:

undefined
undefined
Error: unable to get local issuer certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1539:34)
    at TLSSocket.emit (node:events:513:28)
    at TLSSocket._finishInit (node:_tls_wrap:953:8)
    at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:734:12) {
  code: 'HANDSHAKE_SSL_ERROR',
  fatal: true
}

ls-pieter-vanisacker avatar Jul 12 '23 14:07 ls-pieter-vanisacker

thanks for the report @ls-pieter-vanisacker , I'll check that. Likely a side effect of #2119

Could you try with ssl: { rejectUnauthorized: false, ca: [ copy from https://github.com/sidorares/node-mysql2/blob/af6b6dcc63709956a06a09131ac7cc152a09b3d5/lib/constants/ssl_profiles.js#L8 ] } ?

sidorares avatar Jul 13 '23 06:07 sidorares