trusted root store update for Azure Database for PostgreSQL

[srajasimman]

Hi All,

We are currently using Sunbird 5.0.0 release in our production environment which is hosted in Azure Cloud

We received the following notification from Azure Cloud Service Provider. we would like what is the impact on our application and if yes then what action is required from our side. kindly clarify.

Update your trusted root store for Azure Database for PostgreSQL Single Server by 30 November 2022

You're receiving this notification because you use Azure Database for PostgreSQL Single Server.

In December 2022, we'll begin updating Azure Database for PostgreSQL Single Server to use TLS certificates from DigiCert Global Root G2. If your apps use certificate pinning, you'll need to update your trusted root store by 30 November 2022.

Required action

To avoid potential service disruptions, follow these instructions to check if your apps will be affected. If they'll be affected, continue to follow the instructions to add DigiCert Global Root G2 and intermediate certificate authorities to your trusted root store for Azure Database for PostgreSQL Single Server by 30 November 2022.

cc: @santhosh-tg @keshavprasadms

[beepdot]

Hello @srajasimman We will check the impact and update here once we have completed our evaluation.
cc @gandham-santhosh

[srajasimman]

Hi @keshavprasadms any update?

[gandham-santhosh]

@srajasimman As far as I am aware we are not using TLS/SSL way of connecting to postgreSQL from apps. I also suggest to raise ticket with Azure team and check how this can be tested in a non-prod environment like preprod to prove that there is no impact

@sharathkashyap @vinukumar-vs @anandp504 @maheshkumargangula @ pallakartheekreddy @reshmi-nair can you please confirm if any application part of your BB uses certificate pinning to connect with postgresql.

[beepdot]

Here is the input from my end - There is no impact due to this change for Keycloak and Kong service. Here is a reference link which can give more insights for other BB champions to comment

• https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-PROTECTION
• https://learn.microsoft.com/en-gb/azure/postgresql/single-server/concepts-certificate-rotation#what-change-will-be-performed-starting-december-2022-122022