2

I am trying to configure the SSL certificates in the MongoDB community edition.

The configuration of my mongod.conf

net:
  port: 27017
  bindIp: 0.0.0.0  # Enter 0.0.0.0,:: to bind to all IPv4 and IPv6 
 addresses or, alternatively, use the net.bindIpAll setting.
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/ca_bundle.crt
    allowConnectionsWithoutCertificates: false
    allowInvalidHostnames: false
    disabledProtocols: TLS1_0,TLS1_1

Here what I am doing is converting certificate.crt and private.key as mongodb.pem and passing the ca_bundle.crt as CAFile in mongod.conf

I am trying to connect with the server using the command

mongo --ssl --sslPEMKeyFile /etc/ssl/mongodb.pem --sslCAFile /etc/ssl/ca_bundle.crt --host myapptest.tk

Getting the error like

MongoDB shell version v4.0.8

connecting to: mongodb://myapptest.tk:27017/?gssapiServiceName=mongodb

2019-04-04T19:57:40.401+0000 E NETWORK [js] SSL peer certificate validation failed: unable to get local issuer certificate

2019-04-04T19:57:40.402+0000 E QUERY [js] Error: couldn't connect to server myapptest.tk:27017, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: unable to get local issuer certificate :

connect@src/mongo/shell/mongo.js:343:13

@(connect):2:6

exception: connect failed

I want to know, how to create the root_CA.pem file and pass it as --sslCAFile?

where can found the ca.pem file in MongoDB?

Could anybody suggest me how to configure the SSL certificates in MongoDB?

1

1 Answer 1

1

how to generate the root CA.pem in mongodb for configuring the ssl certificates?

As per MongoDB documentation here The procedure creates both the CA PEM file and an intermediate authority certificate and key files to sign server/client test certificates.

TESTING PURPOSES ONLY: This will provides some guidelines for creating test x.509 certificates:

  • Do not use these certificates for production. Instead, follow your security policies.
  • For information on OpenSSL, refer to the official OpenSSL docs. Although this tutorial uses OpenSSL, the material should not be taken as an authoritative reference on OpenSSL.

for further your ref here

1
  • 1
    hello Md Haidar Ali Khan. I took a reference as this link <demarcsek92.blogspot.com/2014/05/mongodb-ssl-setup.html> and generated the server.pem and client.pem. we are using both files to connect to the server here. Is there any alternatives to connect to the server by using client.pem?
    – gayathri
    Apr 10, 2019 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.