3 ms·
It's because those regions were created after the 2019 certificate was released. Hence there is no 2015 cert for those. https://docs.aws.amazon.com/AmazonRDS/la
by jontro 7y ago
It's because those regions were created after the 2019 certificate was released. Hence there is no 2015 cert for those. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Using...
- insomniacity 7y agoFair enough - I didn't realise they'd launched regions that recently!
- jontro 7y agoThe Ningxia region might not support encryption. That one was released in 2017. Unsure about this one.
- jon-wood 7y agoYeah, Ningxia is a weird region. It’s run under license by a Chinese company, and KMS isn’t available, which by extension means most encryption isn’t either since that’s all built on top of KMS these days.
- Cpoll 7y agoI wonder why they do that instead of asking for access to the private keys.
- dlgeek 7y agoKMS launched in Ningxia (and Beijing) in June: https://aws.amazon.com/about-aws/whats-new/2019/06/aws-kms-now-available-aws-china-beijing-sinnet-and-aws-china-ningxia-nwcd/ https://aws.amazon.com/about-aws/whats-new/2019/06/aws-kms-n...
- jon-wood 7y agoOh, fair enough, last time I looked into the China regions that didn't exist. Reading the announcement I'm loving the seeming contradiction between " AWS KMS is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Chinese government-approved hardware security modules to protect the security of your keys." and the very next sentence "The service is designed so that no one, including KMS service operators, can retrieve your plaintext master keys from the service." Something tells me those master keys aren't quite as secure as you'd expect in other regions.
- sneak 7y agoThe US government also has their own set of security requirements for AWS regions in the USA that serve the US government.