AWS aurora-dsql high security documentation change

Service: aurora-dsql · 2025-06-10 · Security-related high

File: aurora-dsql/latest/userguide/troubleshooting.md

Summary

Added new 'Troubleshooting SSL/TLS connections' section with specific error resolutions

Security assessment

The added content addresses specific SSL/TLS misconfigurations (e.g., certificate verification failures) and mandates client upgrades to fix security-related errors. The requirement for PostgreSQL 17 suggests addressing known vulnerabilities in older clients.

Diff

diff --git a/aurora-dsql/latest/userguide/troubleshooting.md b/aurora-dsql/latest/userguide/troubleshooting.md
index 01ce08cbf..2c4eb662b 100644
--- a//aurora-dsql/latest/userguide/troubleshooting.md
+++ b//aurora-dsql/latest/userguide/troubleshooting.md
@@ -5 +5 @@
-Connection errorsAuthentication errorsAuthorization errorsSQL errorsOCC errors
+Connection errorsAuthentication errorsAuthorization errorsSQL errorsOCC errorsSSL/TLS connections
@@ -24,0 +25,2 @@ The following topics provide troubleshooting advice for errors and issues that y
+  * Troubleshooting SSL/TLS connections
+
@@ -117,0 +120,23 @@ When you retry at time T3 from the original session, Aurora DSQL refreshes the c
+## Troubleshooting SSL/TLS connections
+
+**SSL error: certificate verify failed**
+
+This error indicates that the client cannot verify the server's certificate. Ensure that:
+
+  1. The Amazon Root CA 1 certificate is properly installed. See [Configuring SSL/TLS certificates for Aurora DSQL connections](./configure-root-certificates.html) for instructions on how to validate and install this certificate. 
+
+  2. The `PGSSLROOTCERT` environment variable points to the correct certificate file.
+
+  3. The certificate file has the correct permissions.
+
+
+
+
+**Unrecognized SSL error code: 6**
+
+This error occurs with PostgreSQL clients below version 14. Upgrade your PostgreSQL client to version 17 to resolve this issue.
+
+**SSL error: unregistered scheme (Windows)**
+
+This is a known issue with the Windows psql client when using system certificates. Use the downloaded certificate file method described in the [Connecting from Windows](./configure-root-certificates.html#connect-windows) instructions.
+