I'm setting up a MongoDB server, and wanted to use TLS from a proper CA and DNS. I got a domain name and put an A record in, linking to my server. Afterwards, I applied for a SSL certificate on sectigo.com. By their instructions, I generated a key and CSR. After confirming I did indeed own the domain name they sent me two files: a signed crt file, and a ca-bundle file.

I uploaded these to my server to /etc/ssl/mongodb_server and combined the signed .crt file and .key file into a pem with cat server.key server.crt | server.pem. I then filled in the mongod.conf file as per the documentation:

  dbPath: /var/lib/mongodb
    enabled: true

  destination: file
  logAppend: true
  verbosity: 5
  path: /var/log/mongodb/mongod.log

  port: 27017
  bindIp: <my_local_ip>
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb_server/server.pem
    allowConnectionsWithoutCertificates: true

  timeZoneInfo: /usr/share/zoneinfo

  authorization: enabled

I'm looking to set up my server so client's don't need a ca signed certificate to connect, as this server will mainly be an API for a piece of software to grab files from. Based on this link https://docs.mongodb.com/manual/tutorial/configure-ssl-clients/#std-label-tls-client-connection-only The client needs to just specify a tlsCAFile to validate the server's certificate. I assume this is that ca-bundle.pem I was given as it includes two certificates that I assume are a chain of ca's for my certificate?

When I run: mongosh --port XXXXX --host <my_domain_name> --tls --tlsCAFile ./ca-bundle.pem after a while it comes back with: MongoServerSelectionError: unable to get issuer certificate. It is only able to connect when I specify the flag --tlsAllowInvalidCertificates, which is not good enough. I tried adding allowConnectionWithoutCertificates: true to the config, as well as adding the CAFile ca-bundle.pem, but nothing changed. I also tried connecting from multiple devices and such. My mongodb is bound to a local_ip, on which a modem router has port forwarding to the server. I'm also using IP tables to change ports to 27017. I'm able to ping my server's public IP and also dig for the DNS records. But none of this should matter as I'm able to connect if I don't validate the server's certificate.

I've used openssl to check that my certificate does in fact mention my domain, and that is not expired. I'm running MongoDB on Ubuntu Server 20.04 via a conf file and systemctl.

Is there some step I'm missing?

  • "unable to get issuer certificate" tells me that Mongo cannot find the CA certificate, or that it itself is not trusted.
    – mustaccio
    Nov 25 at 12:26

After trying a few permutations of different settings I found, and confirming my certificate could be verified by CA with openssl commands.

I figured out that all I needed to do was connect with port, host and --tls --tlsCertificateSelector options. This means the client will use the systemCA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.