Using SSL/TLS to encrypt connection to DB Instance

Goal

Encrypt the connection between application server and DB.

Solution

You can create RDS with default SSL cert provided by AWS.

Check this using below command in MySQL tool.

SHOW VARIABLES LIKE '%SSL%';

Step 1: Setup the connection properties in connector string “useSSL=true&trustServerCertificate=true”

Example:

jdbc:mariadb://<dbhost>:3306/abc?useSSL=true&trustServerCertificate=true

Step 2: Setup SSL connections for specific users accounts.

CREATE USER 'appuser'@'%' REQUIRE SSL;

Important Note: Default RDS cert has an expiration date and need to be rotated.

Reference:

Using SSL/TLS to encrypt a connection to a DB instance

Rotating your SSL/TLS certificate