# Proxysql SSL ca cert RDS

**URL:** <https://forums.percona.com/t/proxysql-ssl-ca-cert-rds/8662>\
**Category:** ProxySQL\
**Created:** [January 6, 2021, 6:51pm UTC](https://forums.percona.com/t/proxysql-ssl-ca-cert-rds/8662 "2021-01-06T18:51:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![star2star\_lewis](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@star2star\_lewis](https://forums.percona.com/u/star2star_lewis)\
**Post date:** [January 6, 2021, 6:51pm UTC](https://forums.percona.com/t/proxysql-ssl-ca-cert-rds/8662/1 "2021-01-06T18:51:36Z")

</div>

How to connect to RDS with ssl in AWS from Proxysql?  
Only have the CA-cert root certificate from aws to connect to RDS.  
I can connect directly from the server that has proxysql installed.  
mysql -udlewis -p -h [rds.instance.rds.amazonaws.com](http://rds.instance.rds.amazonaws.com) -P3306 --ssl-ca /etc/ssl/certs/rds-ca-2019-root.pem  
I can not connect with ssl from proxysql  
mysql -udlewis -p -h 127.0.0.1 -P3306 --ssl-ca /home/dlewis/rds-ca-2019-root.pem  
or  
mysql -udlewis -p -h 127.0.0.1 -P3306

variables:  
| mysql-have\_ssl | true |  
| mysql-ssl\_p2s\_ca | /etc/mysql/ssl/rds-ca-2019-root.pem |  
| mysql-ssl\_p2s\_cert | |  
| mysql-ssl\_p2s\_key | |  
| mysql-ssl\_p2s\_cipher | |

---

<div class="post-metadata">

**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\
**Post date:** [January 7, 2021, 11:17am UTC](https://forums.percona.com/t/proxysql-ssl-ca-cert-rds/8662/2 "2021-01-07T11:17:35Z")

</div>

Hi, there seems to be a few configs missing. Please check [SSL Encryption at ProxySQL Part 1 - ProxySQL](https://proxysql.com/blog/ssl-at-proxysql-part1/)  
for instructions

---

<div class="post-metadata">

**Author:** ![star2star\_lewis](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@star2star\_lewis](https://forums.percona.com/u/star2star_lewis)\
**Post date:** [February 12, 2021, 3:53pm UTC](https://forums.percona.com/t/proxysql-ssl-ca-cert-rds/8662/3 "2021-02-12T15:53:42Z")

</div>

Can I get a hint at what was missed?

---

<div class="post-metadata">

**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\
**Post date:** [February 15, 2021, 11:50am UTC](https://forums.percona.com/t/proxysql-ssl-ca-cert-rds/8662/4 "2021-02-15T11:50:42Z")

</div>

Hi, front end encryption is different from backend encryption in ProxySQL. The client to proxysql connections (frontend) should use the key/cert generated by proxysql, not the RDS pem file.  
The RDS cert is only used to encrypt backed (proxysql to rds) connections.

See [SSL Support · sysown/proxysql Wiki · GitHub](https://github.com/sysown/proxysql/wiki/SSL-Support#ssl-configuration-for-frontends)

---

<div class="post-metadata">

**Author:** ![bpanigrahi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/bpanigrahi/32/2905_2.png) [@bpanigrahi](https://forums.percona.com/u/bpanigrahi)\
**Post date:** [February 15, 2021, 9:54pm UTC](https://forums.percona.com/t/proxysql-ssl-ca-cert-rds/8662/5 "2021-02-15T21:54:17Z")

</div>

It’s always better to use different key/cert for the frontend and backend connection’s.  
The main challenge is resolving incases where you setup using a public certificate (CA).