bytebase/bytebase · error

failed to build request for rds cert

Error message

failed to build request for rds cert

What it means

getRDSCertPool builds an HTTP GET for the AWS RDS combined CA bundle (rds-combined-ca-bundle.pem on S3). http.NewRequestWithContext fails on an unparsable or invalid URL, or an invalid context, and the driver wraps it as 'failed to build request for rds cert'.

Source

Thrown at backend/plugin/db/mysql/mysql.go:166

			return "", errors.Wrap(err, "sql: failed to register tls config")
		}
		// TLS config is only used during sql.Open, so should be safe to deregister afterwards.
		d.openCleanUp = append(d.openCleanUp, func() { mysql.DeregisterTLSConfig(tlsKey) })
		params = append(params, fmt.Sprintf("tls=%s", tlsKey))
	}
	return fmt.Sprintf("%s:%s@%s(%s:%s)/%s?%s", connCfg.DataSource.Username, connCfg.Password, protocol, connCfg.DataSource.Host, connCfg.DataSource.Port, connCfg.ConnectionContext.DatabaseName, strings.Join(params, "&")), nil
}

// getRDSCertPool downloads and returns the RDS CA certificate pool.
// AWS RDS connection with IAM require TLS connection.
//
// refs:
// https://github.com/aws/aws-sdk-go/issues/1248
// https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/mysql-ssl-connections.html
func getRDSCertPool(ctx context.Context) (*x509.CertPool, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem", nil)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to build request for rds cert")
	}

	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

	pem, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, err
	}

	if err := resp.Body.Close(); err != nil {
		return nil, errors.Wrapf(err, "failed to close response")
	}

View on GitHub (pinned to 1870550677)

Solutions

1. Check the wrapped error for 'net/http: nil Context' or 'invalid control character in URL' details
2. Ensure the ctx passed into Open is not already canceled/deadline-exceeded
3. Verify no custom build or proxy rewrites the S3 CA bundle URL
4. Retry the connection with a fresh context

if err := ctx.Err(); err != nil {
    return fmt.Errorf("cannot download RDS cert pool, context done: %w", err)
}

rootCAs, err := getRDSCertPool(ctx)
if err != nil && errors.Is(err, context.Canceled) {
    // retry with fresh context
}

When it happens

Trigger: http.NewRequestWithContext returns an error — with the hard-coded S3 URL this means the passed ctx is already canceled, or an environment/policy layer rewrote the URL to something invalid.

Common situations: Requesting an RDS IAM connection with a context that timed out earlier in the request chain; proxied/corporate egress setups that mutate outbound URLs; a fork where the CA bundle URL was edited to a bad value.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• failed to close response
• failed to get RDS cert pool
• %s request failed
• failed to execute API request
• failed to read response body

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/0f9d2e234af086d8. Report an issue: GitHub.