The recommended certificate didn't work on Azure Database for PostgreSQL Single server in China east 2 region

Xiaoyun Liao 40 Reputation points
2024-04-18T15:24:54.75+00:00

Hi,

 

I have a question about the Azure Database for PostgreSQL - Single Server (located in China East 2).

 

We recently noticed that there is a warning message in the Azure portal, which is "As a part of routine certificate rotation, the root certificate for the client applications/drivers enabled with SSL has changed. This change could impact your application connectivity to Azure Database for PostgreSQL Single Server if your application uses SSL/TLS and you have not applied the changes recommended in how to maintain connectivity, To mitigate the issue, please apply the recommendations detailed in this article https://learn.microsoft.com/azure/postgresql/single-server/concepts-certificate-rotation?WT.mc_id=Portal-SqlAzureExtension#what-do-i-need-to-do-to-maintain-connectivity".

 

I followed the instructions in the article and updated the root certificate in my service, but the service cannot connect to the database with the new certificate while the old one is working well. The error I got is  “failed to write startup message (tls: failed to verify certificate: x509: certificate signed by unknown authority)”

 

The current root certificate is "DigiCert Global Root CA" and the new one combined "Baltimore CyberTrust Root" and "DigiCert Global Root G2".

 

However, I did the same update for my other same type databases in other regions (USE2, WUE), and it works well with the new certificate. Could you please help me to check if there is any issue with the new certificate in the China region?

 

 

Here is the information of the database server:

{

    "sku": {

        "name": "GP_Gen5_16",

        "tier": "GeneralPurpose",

        "family": "Gen5",

        "capacity": 16

    },

    "properties": {

        "administratorLogin": "dbaadmin",

        "storageProfile": {

            "storageMB": 517120,

            "backupRetentionDays": 7,

            "geoRedundantBackup": "Disabled",

            "storageAutogrow": "Enabled"

        },

        "version": "11",

        "sslEnforcement": "Enabled",

        "minimalTlsVersion": "TLS1_2",

        "userVisibleState": "Ready",

        "fullyQualifiedDomainName": "xxxxxxxx.postgres.database.chinacloudapi.cn",

        "earliestRestoreDate": "2024-04-11T14:54:24.6910027+00:00",

        "replicationRole": "None",

        "masterServerId": "",

        "replicaCapacity": 5,

        "byokEnforcement": "Disabled",

        "privateEndpointConnections": [

        ],

        "infrastructureEncryption": "Disabled",

        "publicNetworkAccess": "Disabled"

    },

"type": "Microsoft.DBforPostgreSQL/servers"

}

Azure Database for PostgreSQL