I'm setting up a MongoDB server, and wanted to use TLS from a proper CA and DNS. I got a domain name and put an A record in, linking to my server. Afterwards, I applied for a SSL certificate on sectigo.com. By their instructions, I generated a key and CSR. After confirming I did indeed own the domain name they sent me two files: a signed crt file, and a ca-bundle file.
I uploaded these to my server to /etc/ssl/mongodb_server and combined the signed .crt file and .key file into a pem with cat server.key server.crt | server.pem
. I then filled in the mongod.conf file as per the documentation:
storage:
dbPath: /var/lib/mongodb
journal:
enabled: true
systemLog:
destination: file
logAppend: true
verbosity: 5
path: /var/log/mongodb/mongod.log
net:
port: 27017
bindIp: <my_local_ip>
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb_server/server.pem
allowConnectionsWithoutCertificates: true
processManagement:
timeZoneInfo: /usr/share/zoneinfo
security:
authorization: enabled
I'm looking to set up my server so client's don't need a ca signed certificate to connect, as this server will mainly be an API for a piece of software to grab files from. Based on this link https://docs.mongodb.com/manual/tutorial/configure-ssl-clients/#std-label-tls-client-connection-only The client needs to just specify a tlsCAFile to validate the server's certificate. I assume this is that ca-bundle.pem I was given as it includes two certificates that I assume are a chain of ca's for my certificate?
When I run:
mongosh --port XXXXX --host <my_domain_name> --tls --tlsCAFile ./ca-bundle.pem
after a while it comes back with: MongoServerSelectionError: unable to get issuer certificate
.
It is only able to connect when I specify the flag --tlsAllowInvalidCertificates
, which is not good enough.
I tried adding allowConnectionWithoutCertificates: true
to the config, as well as adding the CAFile ca-bundle.pem
, but nothing changed.
I also tried connecting from multiple devices and such.
My mongodb is bound to a local_ip, on which a modem router has port forwarding to the server. I'm also using IP tables to change ports to 27017. I'm able to ping my server's public IP and also dig for the DNS records. But none of this should matter as I'm able to connect if I don't validate the server's certificate.
I've used openssl
to check that my certificate does in fact mention my domain, and that is not expired.
I'm running MongoDB on Ubuntu Server 20.04 via a conf file and systemctl.
Is there some step I'm missing?