aws/rds: Switch AWS RDS CA bundle to the officially documented URL

[toadjaune]

Hi folks !

AWS recently started sending out emails about the expiration of the rds-ca-2019 CA (expires in 2024), suggesting we upgrade our instance to rds-ca-rsa2048-g1, rds-ca-rsa4096-g1, or rds-ca-ecc384-g1.

The corresponding documentation is here, and includes instructions as to client configuration and where to retrieve CA information.

I'm assuming the URL used here is a former address, and that AWS has since then changed the address of the reference CA bundle, without updating the bundle at the former address.

Reproduction

Creating RDS instances with both rds-ca-2019 and rds-ca-ecc384-g1, I can confirm that the new bundle works with both, while the old one only works with rds-ca-2019. I have not, however, explicitly listed each certificate in the old bundle to see if it's present in the new one. We can double-check before merging if you wish so, I'm however assuming AWS would not remove still-valid CAs from its bundle.

I'm not using go-cloud directly however, only indirectly through https://github.com/cyrilgdn/terraform-provider-postgresql, so, I haven't been able to test this change directly.
However, using psql with sslrootcert should be a good indicator that the issue is in fact here.

[codecov]

Codecov Report

Merging #3307 (1e92c83) into master (d6f90a4) will increase coverage by 0.05%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #3307      +/-   ##
==========================================
+ Coverage   77.44%   77.49%   +0.05%     
==========================================
  Files         104      104              
  Lines       13923    13923              
==========================================
+ Hits        10782    10790       +8     
+ Misses       2380     2371       -9     
- Partials      761      762       +1     

Files Changed	Coverage Δ
aws/rds/rds.go	0.00% <ø> (ø)

... and 1 file with indirect coverage changes

[toadjaune]

Well, that was fast, thanks a lot !

By any chance, do you have any idea about when we can expect a new release ?

I'm not sure how aggressive AWS is with its "rotate your CA" emails, but this might start affecting a lot of people pretty fast.

[vangent]

when we can expect a new release

Done