MongoDB error: self signed certificate in certificate chain

Question

I'm setting up for test a dockerized MongoDB which uses SSL. Everything goes fine with configuration, but when I'm trying to connect I get the following error:

SSL peer certificate validation failed: self signed certificate in certificate chain.

Here's how I generate my CA and server/client certificates:

# CA
openssl genrsa -out ca/ca.key 2048
openssl req -x509 -new -key ca/ca.key -days 10000 -out ca/ca.crt

# Server
openssl genrsa -out server/mongodb.key 2048
openssl req -new -key server/mongodb.key -out server/mongodb.csr
openssl x509 -req -in server/mongodb.csr -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial -out server/mongodb.crt -days 365
cat server/mongodb.key server/mongodb.crt > server/server.pem

# Client
openssl genrsa -out client/cl.key 2048
openssl req -new -key client/cl.key -out client/cl.csr
openssl x509 -req -in client/cl.csr -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial -out client/cl.crt -days 365
cat client/cl.key client/cl.crt > client/cl.pem

Here's my MongoDB configuration file (disregard the file paths):

net: 
  bindIp: 0.0.0.0
  port: 28018
  ssl: 
    CAFile: /etc/mongo/ssl/ca/ca.crt
    PEMKeyFile: /etc/mongo/ssl/server/server.pem
    mode: requireSSL
storage: 
  dbPath: /mongo/db
  journal: 
  enabled: true

And here's how I'm connecting to it:

mongo --host 127.0.0.1 --port 28018 --ssl --sslCAFile mongoconf/config/ssl/server/server.pem --sslPEMKeyFile mongoconf/config/ssl/client/cl.pem

The local mongoconf/config is mapped to etc/mongo in the container.

Answer 1

You have the --sslCAFile pointing at the server.pem file rather than the CA file which seems to be in /etc/mongo/ssl/ca/ca.crt. As a result the cert you have generated for your client connection is not considered valid.

You have a couple of options, you can allow cert-less connections by clients (they are still SSL encrypted, just no cert to validate the client side). This is done by specifying the allowConnectionsWithoutCertificates option on the server and is functionally equivalent to how HTTPS works on the web.

The other option of course is to fix the sslCAFile path to point at the CA cert rather than the server cert.