mysql - 如何配置 sequelize 和 node mysql 以使用新的 aws rds 根证书 rds-ca-2019

Question

随着 AWS 更改其 2019 年 rds 服务的根 ssl 证书，2015 年的旧证书在 03/2020 失效。见https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html

如何配置 sequalize 以使用新的 rds-ca-2019 证书？

// current sequalize aws rds configuration as of working with 2015 cert
var sequelizeConfig = {
  ...
  host: "xyz.rds.amazonaws.com",
  dialectOptions": {
    ssl: 'Amazon RDS'
  }
}

我想不出任何使用 sequalize 3.x 手动添加证书的选项

Answer 1

确保更新到最新的 Node mysql 包，这可能会在将来解决问题。

截至目前，新的 aws rds-ca-2019 ca 证书似乎尚未合并。 https://github.com/mysqljs/mysql/pull/2280

没有 ca 验证的临时修复:

var sequelizeConfig = {
  ...
  host: "xyz.rds.amazonaws.com",
  dialectOptions: {
    ssl: true
  }
}

并通过证书验证:

// get rds-ca-2019 certificate directly from aws https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem to ensure validity!!!
const fs = require('fs');
const rdsCa = fs.readFileSync(__dirname + '/rds-ca-2019-root.pem');

var sequelizeConfig = {
  ...
  host: "xyz.rds.amazonaws.com",
  dialectOptions: {
    ssl: {
      rejectUnauthorized: true,
      ca: [rdsCa]
    }
  }
}

感谢@jarmod 的链接和帖子 "Best Security Practices for Amazon RDS with Sequelize" by soluto-nashville显示解决方案