{"record":{"id":"0f9d2e234af086d8","repo":"bytebase/bytebase","slug":"failed-to-build-request-for-rds-cert","errorCode":null,"errorMessage":"failed to build request for rds cert","messagePattern":"failed to build request for rds cert","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/plugin/db/mysql/mysql.go","lineNumber":166,"sourceCode":"\t\t\treturn \"\", errors.Wrap(err, \"sql: failed to register tls config\")\n\t\t}\n\t\t// TLS config is only used during sql.Open, so should be safe to deregister afterwards.\n\t\td.openCleanUp = append(d.openCleanUp, func() { mysql.DeregisterTLSConfig(tlsKey) })\n\t\tparams = append(params, fmt.Sprintf(\"tls=%s\", tlsKey))\n\t}\n\treturn fmt.Sprintf(\"%s:%s@%s(%s:%s)/%s?%s\", connCfg.DataSource.Username, connCfg.Password, protocol, connCfg.DataSource.Host, connCfg.DataSource.Port, connCfg.ConnectionContext.DatabaseName, strings.Join(params, \"&\")), nil\n}\n\n// getRDSCertPool downloads and returns the RDS CA certificate pool.\n// AWS RDS connection with IAM require TLS connection.\n//\n// refs:\n// https://github.com/aws/aws-sdk-go/issues/1248\n// https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/mysql-ssl-connections.html\nfunc getRDSCertPool(ctx context.Context) (*x509.CertPool, error) {\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, \"https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem\", nil)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"failed to build request for rds cert\")\n\t}\n\n\tclient := &http.Client{}\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer resp.Body.Close()\n\n\tpem, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif err := resp.Body.Close(); err != nil {\n\t\treturn nil, errors.Wrapf(err, \"failed to close response\")\n\t}\n","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/plugin/db/mysql/mysql.go#L148-L184","documentation":"getRDSCertPool builds an HTTP GET for the AWS RDS combined CA bundle (rds-combined-ca-bundle.pem on S3). http.NewRequestWithContext fails on an unparsable or invalid URL, or an invalid context, and the driver wraps it as 'failed to build request for rds cert'.","triggerScenarios":"http.NewRequestWithContext returns an error — with the hard-coded S3 URL this means the passed ctx is already canceled, or an environment/policy layer rewrote the URL to something invalid.","commonSituations":"Requesting an RDS IAM connection with a context that timed out earlier in the request chain; proxied/corporate egress setups that mutate outbound URLs; a fork where the CA bundle URL was edited to a bad value.","solutions":["Check the wrapped error for 'net/http: nil Context' or 'invalid control character in URL' details","Ensure the ctx passed into Open is not already canceled/deadline-exceeded","Verify no custom build or proxy rewrites the S3 CA bundle URL","Retry the connection with a fresh context"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if err := ctx.Err(); err != nil {\n    return fmt.Errorf(\"cannot download RDS cert pool, context done: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"rootCAs, err := getRDSCertPool(ctx)\nif err != nil && errors.Is(err, context.Canceled) {\n    // retry with fresh context\n}","preventionTips":["Pass live, generous-deadline contexts into database Open","Do not reuse request-scoped contexts that may already be canceled","Pin/verify the CA bundle URL if forking"],"tags":["http","aws","rds","network"],"backgroundTag":"http-request-failed","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}