mxpc-data-migration tool fails with certificate verification error: certificate signed by unknown authority – Mendix

Issue

When using the mxpc-data-migration tool for data backup/restore on a Mendix application deployed on Mendix on Kubernetes, the following certificate verification error is encountered:

"failed to get object: operation error S3: GetObject, exceeded maximum number of attempts, 3, https response error StatusCode: 0,
.. RequestID: , HostID: , request send failed, Get "https://mendix-dev-file-<guid>.s3.<AWS_REGION>.amazonaws.com/mendix-dev-file-..: tls: failed to verify certificate: x509: certificate signed by unknown authority"

The error message indicates that the tool fails to verify the SSL certificate when attempting to connect to the S3 bucket.

Environment

Applications hosted in Mendix on Kubernetes

Cause

The root cause of this issue is that the migration pod mendix-backup-restore is missing the necessary Certificate Authority (CA) certificates to validate the SSL certificate presented by the AWS S3 endpoint. This occurs because the Docker image used for the migration pod does not include the required CA certificates package.

Solution/Workaround

To resolve this issue, install the CA certificates in the migration pod following these steps:

Update the pod creation process to include the installation of CA certificates.

Execute the following command in the migration pod to install and update the certificates:

kubectl exec -it -n <namespace> mendix-backup-restore -- bash -lc "apt-get update && apt-get install -y ca-certificates || true; update-ca-certificates || true; openssl s_client -connect mendix-dev-file-<guid>.s3.<AWS_REGION>.amazonaws.com:443 -servername mendix-dev-file-<guid>.s3.<AWS_REGION>.amazonaws.com -showcerts"

Verify that the certificates are installed correctly by checking for the presence of */etc/ssl/certs/ca-certificates.crt.
Retry the backup/restore process using the mxpc-data-migration tool

Note: If the pod is managed by a Deployment or StatefulSet, update the relevant Kubernetes resource to ensure the changes persist across restarts or redeployments.

As of the latest update, Mendix no longer officially supports the mxpc-data-migration tool. For future data transfer needs, consider the following alternatives:

Contact Mendix Expert Services for assistance with data extraction and transfer
Implement custom backup and restore processes using tools provided by the database vendor or cloud provider
For Azure deployments, consider using the MendixOnAzure built-in backup service

Internal information related

265138

Additional information

Mendix documentation: Private Cloud Data Transfer