Cannot connect to Amazon RDS from within Docker container

I have been banging my head against this for hours and I just do not understand what is going on here. I’m hoping whomever reads this has some idea I haven’t had yet. Basically, within the attached zip file is a very simple project that attempts a connection to an Amazon RDS instance, issues a select 1 = 1, and logs the results. If this project is run normally then the desired result is logged (1 = 1). But if this project is run via a Docker container (as shown in the included run.sh script) then the following will be logged:

{ Error: EE certificate key too weak
    at TLSSocket.<anonymous> (/app/node_modules/mysql/lib/Connection.js:320:48)
    at TLSSocket.emit (events.js:198:13)
    at TLSSocket._finishInit (_tls_wrap.js:636:8)
    --------------------
    at Protocol._enqueue (/app/node_modules/mysql/lib/protocol/Protocol.js:144:48)
    at Protocol.handshake (/app/node_modules/mysql/lib/protocol/Protocol.js:51:23)
    at Connection.connect (/app/node_modules/mysql/lib/Connection.js:119:18)
    at Object.<anonymous> (/app/mysql.js:29:6)
    at Module._compile (internal/modules/cjs/loader.js:778:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
    at Module.load (internal/modules/cjs/loader.js:653:32)
    at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
    at Function.Module._load (internal/modules/cjs/loader.js:585:3)
    at Function.Module.runMain (internal/modules/cjs/loader.js:831:12) code: 'HANDSHAKE_SSL_ERROR', fatal: true }

mysql-wtf.zip

[jsumners]

FYI, both:

• https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem
• https://s3.amazonaws.com/rds-downloads/rds-ca-2019-us-east-1.pem

Yield Signature Algorithm: sha256WithRSAEncryption.

So I’ll try constructing a new pem set to pass in via the connection options tomorrow and see what that does.

[jsumners]

Hmm. The note about 10.x being affected as well lends credence to why I see the same error if I use the centos:latest image and Node via yum install nodejs.

Using rejectUnauthorized: false isn’t such a great idea because it will open the door for a MITM attack (I am fairly sure).

I can investigate some more with this new information tomorrow. But I doubt I’ll get further than you already have (thank you). Let’s tag the only person I know of working on AWS stuff and see what they say. @trivikr can you provide any insight here?