Importing AWS RDS PEM Certificate to Java Keystore using KeyStore Explorer

Download the AWS RDS Certificate Bundle
https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem

After installing you will need to run KeyStore Explorer as root or run as administrator on Windows.

$ sudo /Applications/KeyStore\ Explorer.app/Contents/MacOS/KeyStore\ Explorer

Click Open an existing KeyStore

Choose the keystore you wish to use and enter the password for it. If you are unsure of a password try the word changeit. On macOS the path to the default keystore is under your Java's home directory similar to the path below.

/Library/Java/JavaVirtualMachines/jdk1.8.0_161.jdk/Contents/Home/jre/lib/security/cacerts

Click the Examine menu at the top and click Examine File

Browse to and select the rds-combined-ca-bundle.pem downloaded from AWS in the first step.

Select the Amazon RDS Root CA certificate and click Import

Enter your own or select the default alias and click OK

Click OK on the success import message

Repeat the import steps to import each of the certificates for any of the other AWS regions you want to be able to connect to with SSL.

These are the AWS US regions with a certificate:

Amazon RDS us-east-1 CA
Amazon RDS us-east-2 CA
Amazon RDS us-west-1 CA
Amazon RDS us-west-2 CA

Click OK on the Certificate details for File window.

Finally, be sure to click Save on the cacerts KeyStore to retain the imported certificates.

Now you should be able to securely connect to an AWS RDS MySQL instance with a JDBC connection string similar to the following.

jdbc:mysql://${DBHOST}:3306/${DBNAME}?verifyServerCertificate=true&useSSL=true&requireSSL=true