0

I have set up my mongod instance with the following config:

net:
  port: 27017
  bindIp: 0.0.0.0
  ssl:
    mode: requireSSL
    PEMKeyFile: /config/mongo.pem
    CAFile: /config/ca.pem
    allowConnectionsWithoutCertificates: true

security:
  authorization: enabled

I can connect to it fine with mongosh:

mongosh --host="<mydomain.com>:27017" --username="root" --db="mydbname" --ssl --authenticationDatabase="admin"

But when I try to connect with mongodump using the exact same options...:

mongodump --host="<mydomain.com>:27017" --username="root" --db="mydbname" --ssl --authenticationDatabase="admin"

...It fails with the message Failed: error connecting to db server: no reachable servers. Checking the mongod logs I see the following:

{"t":{"$date":"2023-12-08T13:55:30.966+00:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"<my ip address>","uuid":"41542a35-0815-4fb7-a618-d3ecf6b21a33","connectionId":244,"connectionCount":4}}
{"t":{"$date":"2023-12-08T13:55:30.980+00:00"},"s":"W",  "c":"NETWORK",  "id":23234,   "ctx":"conn244","msg":"No SSL certificate provided by peer"}
{"t":{"$date":"2023-12-08T13:55:30.985+00:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn244","msg":"Connection ended","attr":{"remote":"<my ip address>","uuid":"41542a35-0815-4fb7-a618-d3ecf6b21a33","connectionId":244,"connectionCount":3}}

These three lines are repeated several times until the connection times out.

I'm wondering why it says No SSL certificate provided by peer when I have allowConnectionsWithoutCertificates set to true. It obviously doesn't seem to be a problem when using mongosh as it connects without a problem.

2 Answers 2

0

Parameter CAFile is pointless in your config, because you don't provide any client certificate (and that's the reason why you need allowConnectionsWithoutCertificates: true). Instead it might be required in mongosh and/or mongodump

mongosh --host="<mydomain.com>:27017" --username="root" --db="mydbname" --tlsCAFile=/config/ca.pem --tls --authenticationDatabase="admin"

No SSL certificate provided by peer is just a warning.

mongosh provides option --tlsUseSystemCA which does not exist in mongodump. Maybe try connection string:

mongodump --uri="mongodb://root:password<mydomain.com>:27017?authSource=admin&tls=true&tlsCAFile=/config/ca.pem"

mongosh "mongodb://root:password<mydomain.com>:27017?authSource=admin&tls=true" --tlsUseSystemCA

Maybe have a look at How Security in MongoDB works - which is a bit more advanced.

1
  • I found the solution, posted answer. Due to my mistake of not noticing a line in the log saying the client driver is outdated. Although I wish the server would log the different lines with clear tags in the beginning [ERROR/WARNING/INFO etc.]. Would make it easier. I didn't realize CAFile was only for client certificate verification. Good to know, then I can remove it. Thanks!
    – taxfree
    Dec 9, 2023 at 11:32
0

Figured out the problem. It was due to an outdated version of mongodump.

As I checked the server logs I saw that there was actually one line near the beginning (which I had previously missed) that was different among the repeated ones:

"Received wire protocol op code or command that is no longer supported. The client driver may require an upgrade. For more details see https://dochub.mongodb.org/core/legacy-opcode-removal"

That's when I went to check the mongodump version using mongodump --version and I got the output

mongodump version: built-without-version-string

It was from an outdated mongo-tools package so I uninstalled it with dpkg -P mongo-tools (I'm using OS Ubuntu 20.04) and then followed the instructions on Installing the Database Tools on Linux to install the newer mongodb-database-tools.

Obviously the instructions are gonna different depending on OS/System and which version you want to install, but these were the commands for me:

wget https://fastdl.mongodb.org/tools/db/mongodb-database-tools-ubuntu2004-x86_64-100.9.4.deb
sudo apt install ./mongodb-database-tools-ubuntu2004-x86_64-100.9.4.deb

After getting the latest version of mongodump, it all works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.