With the upcoming changes for the RDS CA (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html) having the option to change this in CloudFormation would help a lot in migrating.

The same goes from AWS::RDS::Cluster (if applicable)