4

I'm setting up for test a dockerized MongoDB which uses SSL. Everything goes fine with configuration, but when I'm trying to connect I get the following error:

SSL peer certificate validation failed: self signed certificate in certificate chain.

Here's how I generate my CA and server/client certificates:

# CA
openssl genrsa -out ca/ca.key 2048
openssl req -x509 -new -key ca/ca.key -days 10000 -out ca/ca.crt

# Server
openssl genrsa -out server/mongodb.key 2048
openssl req -new -key server/mongodb.key -out server/mongodb.csr
openssl x509 -req -in server/mongodb.csr -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial -out server/mongodb.crt -days 365
cat server/mongodb.key server/mongodb.crt > server/server.pem

# Client
openssl genrsa -out client/cl.key 2048
openssl req -new -key client/cl.key -out client/cl.csr
openssl x509 -req -in client/cl.csr -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial -out client/cl.crt -days 365
cat client/cl.key client/cl.crt > client/cl.pem

Here's my MongoDB configuration file (disregard the file paths):

net: 
  bindIp: 0.0.0.0
  port: 28018
  ssl: 
    CAFile: /etc/mongo/ssl/ca/ca.crt
    PEMKeyFile: /etc/mongo/ssl/server/server.pem
    mode: requireSSL
storage: 
  dbPath: /mongo/db
  journal: 
  enabled: true

And here's how I'm connecting to it:

mongo --host 127.0.0.1 --port 28018 --ssl --sslCAFile mongoconf/config/ssl/server/server.pem --sslPEMKeyFile mongoconf/config/ssl/client/cl.pem

The local mongoconf/config is mapped to etc/mongo in the container.

1

1 Answer 1

1

You have the --sslCAFile pointing at the server.pem file rather than the CA file which seems to be in /etc/mongo/ssl/ca/ca.crt. As a result the cert you have generated for your client connection is not considered valid.

You have a couple of options, you can allow cert-less connections by clients (they are still SSL encrypted, just no cert to validate the client side). This is done by specifying the allowConnectionsWithoutCertificates option on the server and is functionally equivalent to how HTTPS works on the web.

The other option of course is to fix the sslCAFile path to point at the CA cert rather than the server cert.

1
  • I also thought so. When I tried to use the actual CA certificate (actually, that's what I tried first) both for starting mongod on the server and mongo on the client, Mongo refused to connect with a Self-Signed Certificate Error. I found my cross-certificate solution on the web.
    – adsalpha
    Oct 7, 2016 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.