Lambda cannot connect to RDS over TLS after upgrading from Node.js 18 to Node.js 20 or later

Error: self-signed certificate in certificate chain

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

Up to Node.js 18, Lambda loaded Amazon CA certificates, including the RDS ones, automatically. From Node.js 20 it no longer does, so the RDS server chain is not trusted.

Fix

Bundle the RDS certificate bundle for your Region and point NODE_EXTRA_CA_CERTS at it, or point it at the Amazon CA file the runtime ships. Pass certificate contents, not a path, when you hand a CA to the driver yourself.

Apply

aws lambda update-function-configuration --function-name my-fn \
  --environment 'Variables={NODE_EXTRA_CA_CERTS=/var/runtime/ca-cert.pem}'
# faster cold starts: ship certificates/rds.pem and use /var/task/certificates/rds.pem

Affects: Lambda nodejs20.x and every later Node.js runtime; zip and container deployments

Sources

https://docs.aws.amazon.com/lambda/latest/dg/lambda-nodejs.html

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp