When the communication encryption is enabled for PostgreSQL database, by doing the following:

1. Open the \webclient\webapps\ROOT\WEB-INF\dsm.properties file in a text editor.
2. Add the following line:

   database.PostgreSQL.connectionParameters=ssl=true

Deep Security uses the default Java runtime cacerts to verify the PostgreSQL server certificate. If the certificate is self-signed or from AWS RDS, it requires to import the cacerts. This file will be upgraded when the DSM is upgraded. It is recommended to do the following workaround to avoid this issue.

Use this workaround for Linux:

1. Download the AWS RDS certificate from this AWS user guide.
2. Copy the java runtime cacerts to /opt/dsm:

   cp /opt/dsm/jre/lib/security/cacerts /opt/dsm/cacerts

3. Import certificate to /opt/dsm/cacerts:

   /opt/dsm/jre/bin/keytool -import -alias rds-root -keystore /opt/dsm/cacerts -file rds-ca-2019-root.der -storepass <changeit>

4. Create a file named dsm_s.vmoptions in the /opt/dsm/ and add the following text in the file:

   -Djavax.net.ssl.trustStore=/opt/dsm/cacerts
   -Djavax.net.ssl.trustStorePassword=<changeit>

Use this workaround for Windows:

1. Download AWS RDS certificate from this AWS user guide.
2. Copy the java run time cacerts to C:\Program Files\Trend Micro\Deep Security Manager:

   copy C:\Program Files\Trend Micro\Deep Security Manager\jre\lib\security\cacerts C:\Program Files\Trend Micro\Deep Security\cacerts

3. Import certificate to C:\Program Files\Trend Micro\Deep Security\cacerts:

   C:\Program Files\Trend Micro\Deep Security Manager\jre\bin\keytool -import -alias rds-root -keystore C:\Program Files\Trend Micro\Deep Security\cacerts
   -file rds-ca-2019-root.der -storepass <changeit>

4. Create a file named Deep Security Manager.vmoptions in the C:\Program Files\Trend Micro\Deep Security Manager and add the following text in the file:

   -Djavax.net.ssl.trustStore to C:\Program Files\Trend Micro\Deep Security Manager\cacerts
   -Djavax.net.ssl.trustStorePassword=<changeit>