Unknown database error after updating the MySQL RDS database certificate on AWS

Developer help
1

If you’re looking for help, please provide information about your environment. If you delete this template and don’t provide any information, your topic will be automatically closed.

If you aren’t running the latest version of Ghost, the first thing we’ll ask you to do is update to the latest version of Ghost.

And

  • How was Ghost installed and configured?
    **It was installed on AWS, and it worked fine until recently AWS asked users to update the certificate of MySQL RDS to rds-ca-rsa2048-g1
  • What Node version, database, OS & browser are you using?
    The instance is running on AWS EC2 (Linux), the node versions is v16.20.1, I am using MySQL RDS provided by AWS.
  • What errors or information do you see in the console?
ul 07 03:24:36 ip-172-31-41-64 node[3739]: - Inspecting operating system
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] INFO Ghost is running in production...
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] INFO Your site is now available on https://vincentyuan.us/
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] INFO Ctrl+C to shut down
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] INFO Ghost server started in 1.862s
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] INFO Bootstrap client was closed.
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] ERROR self signed certificate in certificate chain
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: 
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: self signed certificate in certificate chain
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: "Unknown database error"
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: Error ID:
Jul 07 03:24:38 ip-172-31-41-64 node[3768]:     500
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: Error Code: 
Jul 07 03:24:38 ip-172-31-41-64 node[3768]:     HANDSHAKE_SSL_ERROR
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: ----------------------------------------
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: Error: self signed certificate in certificate chain
Jul 07 03:24:38 ip-172-31-41-64 node[3768]:     at /var/www/sitename/versions/5.54.0/node_modules/knex-migrator/lib/database.js:57:19
Jul 07 03:24:38 ip-172-31-41-64 node[3768]:     at TLSSocket.<anonymous> (/var/www/sitename/versions/5.54.0/node_modules/mysql2/lib/connection.js:379:42)
Jul 07 03:24:38 ip-172-31-41-64 node[3768]:     at TLSSocket.emit (node:events:513:28)
Jul 07 03:24:38 ip-172-31-41-64 node[3768]:     at TLSSocket._finishInit (node:_tls_wrap:953:8)
Jul 07 03:24:38 ip-172-31-41-64 node[3768]:     at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:734:12)
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: 
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] WARN Ghost is shutting down
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] WARN Ghost has shut down
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] WARN Your site is now offline
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] WARN Ghost was running for a few seconds
Jul 07 03:24:38 ip-172-31-41-64 node[3768]: [2024-07-07 03:24:38] INFO Bootstrap client was closed.
Jul 07 03:24:38 ip-172-31-41-64 systemd[1]: Stopping Ghost systemd service for blog: vincentyuan-us...
Jul 07 03:24:39 ip-172-31-41-64 node[3739]: /usr/lib/node_modules/ghost-cli/lib/process-manager.js:46
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:         throw error;
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:         ^
Jul 07 03:24:39 ip-172-31-41-64 node[3739]: {
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:   message: {
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     statusCode: 500,
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     errorType: 'DatabaseError',
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     level: 'critical',
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     message: 'Ghost was able to start, but errored during boot with: self signed certificate in certificate chain',
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     id: 500,
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     help: 'Unknown database error',
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     name: 'DatabaseError',
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     code: 'HANDSHAKE_SSL_ERROR',
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     property: null,
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     redirect: null,
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     hideStack: false,
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:     fatal: true
Jul 07 03:24:39 ip-172-31-41-64 node[3739]:   }
Jul 07 03:24:39 ip-172-31-41-64 node[3739]: }
Jul 07 03:24:39 ip-172-31-41-64 systemd[1]: ghost_vincentyuan-us.service: Main process exited, code=exited, status=1/FAILURE
Jul 07 03:24:39 ip-172-31-41-64 systemd[1]: ghost_vincentyuan-us.service: Failed with result 'exit-code'.
Jul 07 03:24:39 ip-172-31-41-64 systemd[1]: Stopped Ghost systemd service for blog: vincentyuan-us.

below is part of the connection setup in the config:

"database": {
    "client": "mysql",
    "connection": {
      "host": "",
      "user": "",
      "password": "",
      "database": "ghost-db",
      "ssl": "Amazon RDS"
    }
  },

I am not sure if I need to update something in the SSL part. The Ghost doc says if I use RDS, it should be good just like above, and it used to work until recently the certificate of the MySQL RDS is updated.

2

Where are you providing the certificate file or key into the config?

3

In the Ghost doc,

“ssl”: “Amazon RDS” is enough and it worked until I updated the certificate of my RDS.

Should I use this way?

"database": {
  "client": "mysql",
  "connection": {
    "host": "your_cloud_database",
    "port": 3306,
    "user": "your_database_user",
    "password": "your_database_password",
    "database": "your_database_name",
    "ssl": {
      "ca": "-----BEGIN CERTIFICATE-----\nMIIFY... truncated ...pq8fa/a\n-----END CERTIFICATE-----\n"
    }
  }
}
4

Look out, there is a difference between a CA (Cert Authority) and client keys/certificates, are you sure that the CA cert is what you need to authenticate against amazon db?