启用TLS后连接AWS RDS Proxy报本地颁发者证书错误求助

以下是针对你的问题的几种可行解决方案：

1. 使用绝对路径加载证书 #

相对路径可能因进程启动的工作目录不同导致证书找不到，改用绝对路径确保加载正确：

import fastifyMysql from "@fastify/mysql";
import { readFileSync } from "fs";
import path from "path";

fastify.register(fastifyMysql, {
    host: process.env.MYSQL_HOST,
    user: process.env.MYSQL_USER,
    password: process.env.MYSQL_PASSWORD,
    database: process.env.MYSQL_DATABASE,
    promise: true,
    ssl: {
      ca: readFileSync(path.join(__dirname, "ap-southeast-1-bundle.pem"))
    }
});

2. 直接使用系统内置CA证书 #

Amazon Linux 2023的系统信任存储已经包含RDS所需的根证书，无需单独下载，直接引用系统CA路径：

import fastifyMysql from "@fastify/mysql";
import { readFileSync } from "fs";

fastify.register(fastifyMysql, {
    host: process.env.MYSQL_HOST,
    user: process.env.MYSQL_USER,
    password: process.env.MYSQL_PASSWORD,
    database: process.env.MYSQL_DATABASE,
    promise: true,
    ssl: {
      ca: readFileSync("/etc/pki/tls/certs/ca-bundle.crt")
    }
});

3. 验证证书与端点的兼容性 #

用openssl命令检查下载的证书是否能正确验证RDS Proxy端点：

openssl s_client -connect ${MYSQL_HOST}:3306 -CAfile ap-southeast-1-bundle.pem

如果命令返回Verify return code: 0 (ok)，说明证书有效；若失败，重新下载证书：

curl -o ap-southeast-1-bundle.pem https://truststore.pki.rds.amazonaws.com/ap-southeast-1/ap-southeast-1-bundle.pem

4. 升级依赖版本 #

旧版的mysql2（@fastify/mysql的底层依赖）可能存在SSL处理bug，升级依赖：

npm update @fastify/mysql mysql2

内容的提问来源于stack exchange，提问作者nmd19