I’m trying to connect my Java application to my AWS RDS PostgresQL instance. No matter what I try I get a different SSL error. I use this postgres url:

vertx-reactive:postgresql://${REGISTRY_DB_HOST}:${REGISTRY_DB_PORT}/${REGISTRY_DB_NAME}?sslmode=prefer&sslrootcert=/etc/certs/rds-ca-bundle.pem

which leads to this error:

io.vertx.pgclient.PgException: FATAL: no pg_hba.conf entry for host "<pod_ip>", user "<user>", database "<db_name>", no encryption (28000)

By googling I found that this error means the server is expecting a client cert that is validated by its CA. But that contradicts what I read, that AWS RDS PostgresQL does not check client certificates; it merely presents its own certificate which your client can choose to trust or not, and relies on user/pw for authentication.

So I generated a cert and key and put them on my pod, and added them to the postresQL url:

vertx-reactive:postgresql://${REGISTRY_DB_HOST}:${REGISTRY_DB_PORT}/${REGISTRY_DB_NAME}?sslmode=prefer&sslrootcert=/etc/certs/rds-ca-bundle.pem&sslcert=/app/psql_client.crt&sslkey=/app/psql_client.key

Which leads to:

SSLHandShakeError

on the Java side. On the server side I see:

LOG:  could not accept SSL connection: SSLV3_ALERT_CERTIFICATE_UNKNOWN

Which googling suggest that the server is trying to validate the client cert but failing. That makes sense, as it was a self-generated cert.

So I’m in a double-bind:

(1) AWS RDS requires the client to present a client cert.
(2) AWS RDS does not provide any way to generate a client cert that it can validate with its CA.
(3) AWS RDS states in its documentation that postgres does not check client certs.

One of these or more are probably wrong but I cannot figure out which. They seem true from my observation.