SingleCertValidatingFactory not working with AWS RDS global-bundle.pem?

[kamatvishal]

Hi,

I want to use the https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem which is stored in my application jar i.e. using classpath. So I tried using the below jdbc url

jdbc:postgresql://<db-endpoint>:5432/pgdb?ssl=true&sslmode=verify-full&sslfactory=org.postgresql.ssl.SingleCertValidatingFactory&sslfactoryarg=classpath:global-bundle.pem

However, I am getting an exception

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Instead of classpath: I tried file: as well but same exception.

Without using SingleCertValidatingFactory, the .pem file works with file system path like below

jdbc:postgresql://<db-endpoint>:5432/pgdb?ssl=true&sslmode=verify-full&sslrootcert=/app/certs/global-bundle.pem

Does SingleCertValidatingFactory not work with .pem files? What do I need to do to make it work. Any help is appreciated.

Thanks
Vishal

[davecramer]

I think you need to convert it to a .der file see https://jdbc.postgresql.org/documentation/ssl/

Let me know how this goes.

[kamatvishal]

Thanks @davecramer. I tried the .der file but that didn't work. However, when I try with just single region pem file https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem, it works fine. The issue seems to occur with global-bundle.pem which has all the regional certificates combined.

[davecramer]

@kamatvishal does it work in .pem format or .der format?

[kamatvishal]

The us-east-1-bundle works in .pem format. jdbc:postgresql://:5432/pgdb?ssl=true&sslmode=verify-full&sslfactory=org.postgresql.ssl.SingleCertValidatingFactory&sslfactoryarg=classpath:us-east-1-bundle.pem

[davecramer]

Thanks for the information!