Note: As specified in my comment I've figured out a solution to this issue regarding a single client/mongo connection. The next step is to figure out a solution for a replica set involving this fix.
So I've been looking into adding SSL into my MongoDB replica set recently and ended up rebuilding Mongo 2.7.8-pre using SCONS. It built fine and I was able to test the newer version of mongo.exe, mongod.exe and mongos.exe with the "allowSSL" mode without generating any certificates.
I was looking around at different tutorials on generating server and client side SSL certs with a root CA and came across this site: http://acs.lbl.gov/~boverhof/openssl_certs.html
If you don't want to navigate to the page it basically:
- Creates a CA
- Creates a server key/cert pair
- Creates a client key/cert pair
After generating everything I concatenated the keys and certificates into a server.pem and client.pem file because from the docs it seems like Mongo needs both in a .pem file in order for it to work properly.
This left me with:
- ca.pem file with the root certificate
- server.pem file with the server cert/key (subject - ...O = company1, OU = dept1...)
- client.pem file with the client cert/key (subject - ...O = company1, OU = dept2...)
I was able to restart my services fine using ca.pem and server.pem. However, when I went to connect to the nodes using the client with the following command:
mongo --ssl --sslPEMKeyFile "C:\MongoDB\ssl\client.pem" --sslCAFile "C:\MongoDB\ssl\ca.pem"
It gives me this error:
E NETWORK SSL peer certificate validation failed:self signed certificate
I've tried to add the client cert to the root CA that I generated because it was suggested that this is my issue but it does not resolve the problem. I tried adding the subject from the client certificate as a new user to the database as suggested for x509 authentication but this also does not resolve the issue.
I would appreciate any help or suggestions as to why my certificates are failing trust because I think at the moment I'm just being road-blocked by a lack of understanding.
Thanks!