MongoDB TLS unable to get issuer certificate

Question

I'm setting up a MongoDB server, and wanted to use TLS from a proper CA and DNS. I got a domain name and put an A record in, linking to my server. Afterwards, I applied for a SSL certificate on sectigo.com. By their instructions, I generated a key and CSR. After confirming I did indeed own the domain name they sent me two files: a signed crt file, and a ca-bundle file.

I uploaded these to my server to /etc/ssl/mongodb_server and combined the signed .crt file and .key file into a pem with cat server.key server.crt | server.pem. I then filled in the mongod.conf file as per the documentation:

storage:
  dbPath: /var/lib/mongodb
  journal:
    enabled: true

systemLog:
  destination: file
  logAppend: true
  verbosity: 5
  path: /var/log/mongodb/mongod.log

net:
  port: 27017
  bindIp: <my_local_ip>
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb_server/server.pem
    allowConnectionsWithoutCertificates: true

processManagement:
  timeZoneInfo: /usr/share/zoneinfo

security:
  authorization: enabled

I'm looking to set up my server so client's don't need a ca signed certificate to connect, as this server will mainly be an API for a piece of software to grab files from. Based on this link https://docs.mongodb.com/manual/tutorial/configure-ssl-clients/#std-label-tls-client-connection-only The client needs to just specify a tlsCAFile to validate the server's certificate. I assume this is that ca-bundle.pem I was given as it includes two certificates that I assume are a chain of ca's for my certificate?

When I run: mongosh --port XXXXX --host <my_domain_name> --tls --tlsCAFile ./ca-bundle.pem after a while it comes back with: MongoServerSelectionError: unable to get issuer certificate. It is only able to connect when I specify the flag --tlsAllowInvalidCertificates, which is not good enough. I tried adding allowConnectionWithoutCertificates: true to the config, as well as adding the CAFile ca-bundle.pem, but nothing changed. I also tried connecting from multiple devices and such. My mongodb is bound to a local_ip, on which a modem router has port forwarding to the server. I'm also using IP tables to change ports to 27017. I'm able to ping my server's public IP and also dig for the DNS records. But none of this should matter as I'm able to connect if I don't validate the server's certificate.

I've used openssl to check that my certificate does in fact mention my domain, and that is not expired. I'm running MongoDB on Ubuntu Server 20.04 via a conf file and systemctl.

Is there some step I'm missing?

Answer 1

After trying a few permutations of different settings I found, and confirming my certificate could be verified by CA with openssl commands.

I figured out that all I needed to do was connect with port, host and --tls --tlsCertificateSelector options. This means the client will use the systemCA.