RDS encryption in-transit (SSL)

• When you create an SQL Server DB instance, RDS creates an SSL certificate for it.

• There are 2 ways to use SSL to connect to your SQL Server DB instance:

  • Force SSL for all connections - Happens transparently to the client, and the client doesn't have to do any work to use SSL.

  • Encrypt specific connections - Sets up an SSL connection from a specific client computer, and you must do work on the client to encrypt connections.

• If you want to force SSL, use the rds.force_ssl parameter.

  • The rds.force_ssl parameter is static, so after you change the value, you must reboot your DB instance for the change to take effect.

• You can also download the RDS Root CA certificate and import the certificate to your servers and configure your application to use SSL to encrypt the connection to RDS.