5

I have enabled SSL on MongoDB with optional SSL connection: preferred.

I have used lets encrypt in order to obtain SSL certificates. SSLs works as expected and in mongod.log file I can see that:

2018-06-02T06:46:26.664+0000 I NETWORK  [listener] connection accepted from MY_SERVER_IP:45442 #2953818 (121 connections now open)
2018-06-02T06:46:26.664+0000 I NETWORK  [conn2953818] SSL mode is set to 'preferred' and connection 2953818 to MY_SERVER_IP:45442 is not using SSL.

Now on the same host I try to connect to mongo using mongo client command like below:

mongo --ssl --host mongo.example.com --sslPEMKeyFile /etc/ssl/mongo.pem --sslCAFile /etc/ssl/ca.pem

when I use SSL mongo gives error:

MongoDB shell version v3.6.2
connecting to: mongodb://mongo.example.com:27017/
2018-06-02T06:48:34.156+0000 E NETWORK  [thread1] SSL peer certificate validation failed: unable to get issuer certificate
2018-06-02T06:48:34.164+0000 E QUERY    [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: unable to get issuer certificate :
connect@src/mongo/shell/mongo.js:251:13
@(connect):1:6
exception: connect failed

Why it reports that unable to get issuer certificate? Is there something in between that I have missed? Could someone shed some light on this?

EDIT1:

I tried the below command too and got the error network error:

root@example2:~# mongo --ssl --host='mongo.domain.com' --port=27017
MongoDB shell version: 3.2.11
connecting to: mongo.domain.com:27017/test
2018-06-02T08:31:13.501+0000 E QUERY    [thread1] Error: network error while attempting to run command 'isMaster' on host 'mongo.domain.com:27017'  :
connect@src/mongo/shell/mongo.js:231:14
@(connect):1:6

exception: connect failed

Now getting error network error while attempting to run command 'isMaster' on host.

In MongoDB server log it reports that:

Error receiving request from client: SSLHandshakeFailed: SSLHandshakeFailed. Ending connection from 127.0.0.1:32793 (connection id: 358957)
Improve this question

2 Answers 2

Reset to default
5

By removing CAFile: /etc/ssl/ca.pem option from mongoDB config file, problem gone away.

Improve this answer
2
  • It does go away, and that helped, but then mongod warns of no SSL certificate validation because no CA file.
    – jma
    Commented Jul 30, 2018 at 6:43
  • 1
    @jma I have used x509 self signed certificate using openssl and provided both CAFile & PEMKeyFile to mongodb. With this configuration I have no problem.
    – Alireza
    Commented Jul 30, 2018 at 7:40
0

I use tls arguments instead of ssl, in the following way:

mongo "mongodb://MONGOHOST:27017"  \
        --tlsCertificateKeyFile /etc/certs/mongodb-cert-key.pem \
        --tls \
        --tlsCAFile /etc/certs/CA-cert.pem

where

  • MONGOHOST should be in your /etc/hosts file
  • mongodb-cert-key.pem should have the certificate AND the key
  • CA-cert.pem must contain the certificate of the CA related to the previous certificate (mongodb-cert-key.pem)

https://docs.mongodb.com/v4.2/reference/configuration-options/#security-options

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.