AWS RDS instances come with a specific [CA Certificate Identifier](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html) when created. In a somewhat rare event, later this year the default certificate (`rds-ca-2019`) is to expire. For existing instances this will need to be updated. There are various valid options however with different algorithms so we shouldn't select a default here. The right approach is to allow for the [field](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#ca_cert_identifier) to be configured if the user desires but also crucially set to `null` to also allow users to do this action separately and avoid Terraform state clashes. <!-- Set Work Type label(s) for the Issue - https://about.gitlab.com/handbook/engineering/metrics/#work-type-classification --> <!-- Note: Only one subtype should be selected -->