I'm setting up a MongoDB server, and wanted to use TLS from a proper CA and DNS. I got a domain name and put an A record in, linking to my server. Afterwards, I applied for a SSL certificate on sectigo.com. By their instructions, I generated a key and CSR. After confirming I did indeed own the domain name they sent me two files: a signed crt file, and a ca-bundle file.
I uploaded these to my server to /etc/ssl/mongodb_server and combined the signed .crt file and .key file into a pem with
cat server.key server.crt | server.pem. I then filled in the mongod.conf file as per the documentation:
storage: dbPath: /var/lib/mongodb journal: enabled: true systemLog: destination: file logAppend: true verbosity: 5 path: /var/log/mongodb/mongod.log net: port: 27017 bindIp: <my_local_ip> tls: mode: requireTLS certificateKeyFile: /etc/ssl/mongodb_server/server.pem allowConnectionsWithoutCertificates: true processManagement: timeZoneInfo: /usr/share/zoneinfo security: authorization: enabled
I'm looking to set up my server so client's don't need a ca signed certificate to connect, as this server will mainly be an API for a piece of software to grab files from. Based on this link https://docs.mongodb.com/manual/tutorial/configure-ssl-clients/#std-label-tls-client-connection-only The client needs to just specify a tlsCAFile to validate the server's certificate. I assume this is that ca-bundle.pem I was given as it includes two certificates that I assume are a chain of ca's for my certificate?
When I run:
mongosh --port XXXXX --host <my_domain_name> --tls --tlsCAFile ./ca-bundle.pem after a while it comes back with:
MongoServerSelectionError: unable to get issuer certificate.
It is only able to connect when I specify the flag
--tlsAllowInvalidCertificates, which is not good enough.
I tried adding
allowConnectionWithoutCertificates: true to the config, as well as adding the
CAFile ca-bundle.pem, but nothing changed.
I also tried connecting from multiple devices and such.
My mongodb is bound to a local_ip, on which a modem router has port forwarding to the server. I'm also using IP tables to change ports to 27017. I'm able to ping my server's public IP and also dig for the DNS records. But none of this should matter as I'm able to connect if I don't validate the server's certificate.
openssl to check that my certificate does in fact mention my domain, and that is not expired.
I'm running MongoDB on Ubuntu Server 20.04 via a conf file and systemctl.
Is there some step I'm missing?