TLS problem when using AWS Aurora Certificate

[Carleon]

Hi there,

I'm trying to enable SSL encryption in production for my service under a company ecosystem where I have a Certificate to use.

"env": { "OPENFGA_DATASTORE_URI": { "value": "postgres://xyz.xxx.eee.eu-west-1.rds.amazonaws.com:5432/postgres?ssl=true&sslmode=require&sslrootcert=/home/user/rds-ca.crt" } }

But I get an error from OpenFGA:

panic: initialize postgres datastore: ping db: cannot parse postgres://postgres:xxxxx@host:5432/postgres?ssl=true&sslmode=require&sslrootcert=/home/user/rds-ca.crt: failed to configure TLS (unable to add CA to cert pool)

I'm not sure how to do it, is there any recommendation?

Appreciate any help.
Thank you

[rhamzeh]

Thanks for posting @Carleon - we'll take a look.

Question - how are you running OpenFGA? Is it in docker or as a binary? If using docker, are you sure it is mounted in the appropriate location?

[Carleon]

Thank you for your response! I’m running OpenFGA binary inside a Docker container. The CA certificate file (rds-ca.crt) is included in the Docker image! I'm not sure why it doesn't work.

[Carleon]

I've explored a bit more, and discovered I was using an invalid certificate. So, everything is running as expected. Thank you for your support.

[rhamzeh]

Thank you for the update!