Quantcast
Channel: StackExchange Replication Questions
Viewing all articles
Browse latest Browse all 17268

Issues with self signed certificates, SSL and MongoDB

$
0
0

Note: As specified in my comment I've figured out a solution to this issue regarding a single client/mongo connection. The next step is to figure out a solution for a replica set involving this fix.

So I've been looking into adding SSL into my MongoDB replica set recently and ended up rebuilding Mongo 2.7.8-pre using SCONS. It built fine and I was able to test the newer version of mongo.exe, mongod.exe and mongos.exe with the "allowSSL" mode without generating any certificates.

I was looking around at different tutorials on generating server and client side SSL certs with a root CA and came across this site: http://acs.lbl.gov/~boverhof/openssl_certs.html

If you don't want to navigate to the page it basically:

  1. Creates a CA
  2. Creates a server key/cert pair
  3. Creates a client key/cert pair

After generating everything I concatenated the keys and certificates into a server.pem and client.pem file because from the docs it seems like Mongo needs both in a .pem file in order for it to work properly.

This left me with:
- ca.pem file with the root certificate
- server.pem file with the server cert/key (subject - ...O = company1, OU = dept1...)
- client.pem file with the client cert/key (subject - ...O = company1, OU = dept2...)

I was able to restart my services fine using ca.pem and server.pem. However, when I went to connect to the nodes using the client with the following command:

mongo --ssl --sslPEMKeyFile "C:\MongoDB\ssl\client.pem" --sslCAFile "C:\MongoDB\ssl\ca.pem"

It gives me this error:

E NETWORK  SSL peer certificate validation failed:self signed certificate

I've tried to add the client cert to the root CA that I generated because it was suggested that this is my issue but it does not resolve the problem. I tried adding the subject from the client certificate as a new user to the database as suggested for x509 authentication but this also does not resolve the issue.

I would appreciate any help or suggestions as to why my certificates are failing trust because I think at the moment I'm just being road-blocked by a lack of understanding.

Thanks!


Viewing all articles
Browse latest Browse all 17268

Trending Articles