I am enabling TLS/SSL encryption on a remote MongoDB instance (running on Windows Server 2012 R2). On the instance's server,
devserver.external, I have created an SSL certificate. The CN on the subject is
devserver.external and the issuer is
company-issuer. On my computer (the one with which I am connecting to the remote mongo instance, Windows 10) I have
company-issuer in my Intermediate Certification Authorities (when viewed through the Windows certificate manager). This is an internal company operated CA that is trusted on all company machines, including the dev server and my machine.
When connecting to mongo, via either
mongo on the command line or the Robo3t client, the connection succeeds over SSL but
false. From the mongo docs:
A boolean that is true when the TLS/SSL certificate specified by net.ssl.PEMKeyPassword is associated with a certificate authority. **false when the TLS/SSL certificate is self-signed.**
So it would seem mongo is interpreting my CA-signed certificate as a self-signed certificate. This is obviously unwanted behaviour.
systemLog: destination: file path: E:\MongoData\Log\mongod.log storage: dbPath: e:\MongoData\DB setParameter: enableLocalhostAuthBypass: false security: authorization: enabled net: ssl: mode: requireSSL PEMKeyFile: C:\Program Files\MongoDB\Server\3.4\mongodb2.pem
-----BEGIN PRIVATE KEY----- <base64 encoded private key> -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- <base64 encoded certificate> -----END CERTIFICATE-----
I've not included a CA file because as stated in the configuration reference:
Changed in version 3.4: If --sslCAFile is not specified when connecting to an TLS/SSL-enabled server, the system-wide CA certificate store will be used.
My interpretation of this is: As I have not included a
net.ssl.CAFile in my
mongod.cfg, my mongo server will look to the Windows certificate store for a list of trusted CAs. In which it would find my
company-issuer CA, which is the issuer for the certificate in