2

I have enabled SSL on MongoDB with optional SSL connection: preferred.

I have used lets encrypt in order to obtain SSL certificates. SSLs works as expected and in mongod.log file I can see that:

2018-06-02T06:46:26.664+0000 I NETWORK  [listener] connection accepted from MY_SERVER_IP:45442 #2953818 (121 connections now open)
2018-06-02T06:46:26.664+0000 I NETWORK  [conn2953818] SSL mode is set to 'preferred' and connection 2953818 to MY_SERVER_IP:45442 is not using SSL.

Now on the same host I try to connect to mongo using mongo client command like below:

mongo --ssl --host mongo.example.com --sslPEMKeyFile /etc/ssl/mongo.pem --sslCAFile /etc/ssl/ca.pem

when I use SSL mongo gives error:

MongoDB shell version v3.6.2
connecting to: mongodb://mongo.example.com:27017/
2018-06-02T06:48:34.156+0000 E NETWORK  [thread1] SSL peer certificate validation failed: unable to get issuer certificate
2018-06-02T06:48:34.164+0000 E QUERY    [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: unable to get issuer certificate :
connect@src/mongo/shell/mongo.js:251:13
@(connect):1:6
exception: connect failed

Why it reports that unable to get issuer certificate? Is there something in between that I have missed? Could someone shed some light on this?


EDIT1:

I tried the below command too and got the error network error:

root@example2:~# mongo --ssl --host='mongo.domain.com' --port=27017
MongoDB shell version: 3.2.11
connecting to: mongo.domain.com:27017/test
2018-06-02T08:31:13.501+0000 E QUERY    [thread1] Error: network error while attempting to run command 'isMaster' on host 'mongo.domain.com:27017'  :
connect@src/mongo/shell/mongo.js:231:14
@(connect):1:6

exception: connect failed

Now getting error network error while attempting to run command 'isMaster' on host.

In MongoDB server log it reports that:

Error receiving request from client: SSLHandshakeFailed: SSLHandshakeFailed. Ending connection from 127.0.0.1:32793 (connection id: 358957)
3

By removing CAFile: /etc/ssl/ca.pem option from mongoDB config file, problem gone away.

|improve this answer|||||
  • It does go away, and that helped, but then mongod warns of no SSL certificate validation because no CA file. – jma Jul 30 '18 at 6:43
  • 1
    @jma I have used x509 self signed certificate using openssl and provided both CAFile & PEMKeyFile to mongodb. With this configuration I have no problem. – ALH Jul 30 '18 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.