New AWS RDS certificates aren't working

[chanakyagujju]

New AWS RDS ca file isn't working. Always gives me handshake error.

Version : 2.5.5

[sidorares]

can you give more details please? What is the error code? Could you post stack trace? Can you connect with the same code, but without ssl config parameter? Thanks!

[chanakyagujju]

ERROR : { [Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE] code: 'HANDSHAKE_SSL_ERROR', fatal: true }.

I am able to connect if I make rejectUnauthorized : false.

I was able to connect with that RDS instance previously with 2010 CA file.

[dougwilson]

What version of Node.js are you using, as well?

[chanakyagujju]

v0.10.29

[dougwilson]

@sidorares would you mind testing with Node.js 0.10.29 with version 2.5.5?

[sidorares]

I'll try with 0.10.29
My manual tests were using 0.10.36 / iojs 1.2 ( original PR certificates, but as far as I can see you only added comments @dougwilson )

[dougwilson]

Correct, my only modification from the original PR was just to add the comments to know which certificates are which :)

[sidorares]

@chanakyagujju you can try with original certificate instead of using bundled profile: download ca from http://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem and then

  var connection = mysql.createConnection({
    ssl: { ca : fs.readFileSync('/path/to/rds-combined-ca-bundle.pem' }
  });

( or use pre-rotation CA which is going to expire on on 23 March 2015 )

[sidorares]

works fine for me with mysql@2.5.5 from npm and node 0.10.29 ( installed with n )

show status like 'Ssl_cipher'; => [ { Variable_name: 'Ssl_cipher', Value: 'AES256-SHA' } ]

[chanakyagujju]

@sidorares I am using original certificate from aws. Below is my code with which I am trying to connect.

var connection = mysql.createConnection({
  host     : 'host',
  user     : 'user',
  password : 'xxxxxxxxx',
  ssl  : {
          ca : fs.readFileSync(__dirname + '/rds-combined-ca-bundle.pem')
      }
});

with pre-rotation CA same code was successful in connecting to RDS instance. I am sure that instance was configured correctly as I was able to connect to instance from command line with same certificate and also double checked it from AWS.

Should I be using cipher?

[chanakyagujju]

@sidorares @dougwilson you guys there?

Please let me know if I am doing something wrong with my implementation

Thanks!

[dougwilson]

We are :) I don't have access to RDS to know. I mean, this change was contributed by two people, so I assume they didn't have an issue. Unless people are not upgrading, I would also have expected to see other people with your issue drop by here as well.

The thing is, all that was done here was certificates were added to a list. The old cert is still there. Unless there is some problem with your node.js, we're not sure what the issue is. Can you try reinstalling your node.js? Try from a different machine?

[chanakyagujju]

Hi,

I was doing a mistake, previously AWS gave us single certificate to connect. But now they made it like 11 certificates 1 per each region all in one bundled file. I was using that file thinking your module would handle it. I broke it into 11 files and it worked.

Thanks a lot for your time!