Ssl – Cannot connect to MongoDb over SSL

mongodbparse-serverssl

I am trying to follow these instructions to connect to MongoDB over SSL:
https://gist.github.com/leommoore/1e773a7d230ca4bbe1c2

A minor change I made was to use certbot certonly instead of letsencrypt-auto certonly.

In my /etc/letsencrypt/live/redacted.exampledomain.com/

lrwxrwxrwx. 1 root root 51 Oct 19 05:42 cert.pem -> ../../archive/redacted.exampledomain.com/cert1.pem
lrwxrwxrwx. 1 root root 52 Oct 19 05:42 chain.pem -> ../../archive/redacted.exampledomain.com/chain1.pem
lrwxrwxrwx. 1 root root 56 Oct 19 05:42 fullchain.pem -> ../../archive/redacted.exampledomain.com/fullchain1.pem
lrwxrwxrwx. 1 root root 54 Oct 19 05:42 privkey.pem -> ../../archive/redacted.exampledomain.com/privkey1.pem

In my /etc/letsencrypt/archive/redacted.exampledomain.com/ directory I have:

-rw-r--r--. 1 root root 1830 Oct 19 05:42 cert1.pem
-rw-r--r--. 1 root root 1647 Oct 19 05:42 chain1.pem
-rw-r--r--. 1 root root 3477 Oct 19 05:42 fullchain1.pem
-rw-r--r--. 1 root root 1704 Oct 19 05:42 privkey1.pem

This is my script I am using to automate the process:

#!/bin/bash
# from: https://gist.github.com/leommoore/1e773a7d230ca4bbe1c2
SOURCE=/etc/letsencrypt/live/redacted.exampledomain.com
DEST=/etc/ssl/mongodb
cat ${SOURCE}/privkey.pem ${SOURCE}/cert.pem > ${DEST}/mongodb.pem
# (also tried this...)
# cat ${SOURCE}/privkey.pem ${SOURCE}/fullchain.pem > ${DEST}/mongodb.pem

if [ ! -e ${DEST}/ca.crt ] ; then
    # from: https://www.identrust.com/certificates/trustid/root-download-x3.html
    echo "-----BEGIN CERTIFICATE-----" > ${DEST}/ca.crt
    echo "MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/" >> ${DEST}/ca.crt
    echo "MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT" >> ${DEST}/ca.crt
    echo "DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow" >> ${DEST}/ca.crt
    echo "PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD" >> ${DEST}/ca.crt
    echo "Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB" >> ${DEST}/ca.crt
    echo "AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O" >> ${DEST}/ca.crt
    echo "rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq" >> ${DEST}/ca.crt
    echo "OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b" >> ${DEST}/ca.crt
    echo "xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw" >> ${DEST}/ca.crt
    echo "7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD" >> ${DEST}/ca.crt
    echo "aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV" >> ${DEST}/ca.crt
    echo "HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG" >> ${DEST}/ca.crt
    echo "SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69" >> ${DEST}/ca.crt
    echo "ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr" >> ${DEST}/ca.crt
    echo "AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz" >> ${DEST}/ca.crt
    echo "R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5" >> ${DEST}/ca.crt
    echo "JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo" >> ${DEST}/ca.crt
    echo "Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ" >> ${DEST}/ca.crt
    echo "-----END CERTIFICATE-----" >> ${DEST}/ca.crt
    cat ${SOURCE}/chain.pem >> ${DEST}/ca.crt # also tried fullchain.pem, did not work
fi
openssl x509 -in ${DEST}/ca.crt -out ${DEST}/ca.pem -outform PEM
openssl verify -CAfile ${DEST}/ca.crt ${DEST}/mongodb.pem

When I run it, it outputs: /etc/ssl/mongodb/mongodb.pem: OK

I have added these lines to /etc/mongod.conf:

ssl:
  mode: requireSSL
  PEMKeyFile: /etc/ssl/mongodb/mongodb.pem
  CAFile:     /etc/ssl/mongodb/ca.pem

Restarted the service.

I have copied the 2 .pem files to a remote host and am trying to connect remotely with this command:

mongo --ssl -sslCAFile ${HOME}/mongodb/ca.pem --sslPEMKeyFile ${HOME}/mongodb/mongodb.pem redacted.exampledomain.com:27017/testdb

This is the error message I am getting:

2016-10-19T18:53:21.851-0700 E NETWORK  [thread1] SSL peer certificate validation failed: unable to verify the first certificate
2016-10-19T18:53:21.852-0700 E QUERY    [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: unable to verify the first certificate :
connect@src/mongo/shell/mongo.js:231:14
@(connect):1:6

exception: connect failed

What am I doing wrong? How can I fix this? My end goal is to migrate data from parse.com to my own server.

Best Answer

This now connects with this combination:

In the shell script, use fullchain.pem instead of cert.pem
In mongod.conf, do not include a CAFile: line

Install script:

#!/bin/bash
# from: https://gist.github.com/leommoore/1e773a7d230ca4bbe1c2
SOURCE=/etc/letsencrypt/live/redacted.exampledomain.com
DEST=/etc/ssl/mongodb
# use fullchain.pem instead of cert.pem
# cat ${SOURCE}/privkey.pem ${SOURCE}/fullchain.pem > ${DEST}/mongodb.pem

if [ ! -e ${DEST}/ca.crt ] ; then
    # from: https://www.identrust.com/certificates/trustid/root-download-x3.html
    echo "-----BEGIN CERTIFICATE-----" > ${DEST}/ca.crt
    echo "MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/" >> ${DEST}/ca.crt
    echo "MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT" >> ${DEST}/ca.crt
    echo "DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow" >> ${DEST}/ca.crt
    echo "PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD" >> ${DEST}/ca.crt
    echo "Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB" >> ${DEST}/ca.crt
    echo "AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O" >> ${DEST}/ca.crt
    echo "rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq" >> ${DEST}/ca.crt
    echo "OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b" >> ${DEST}/ca.crt
    echo "xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw" >> ${DEST}/ca.crt
    echo "7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD" >> ${DEST}/ca.crt
    echo "aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV" >> ${DEST}/ca.crt
    echo "HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG" >> ${DEST}/ca.crt
    echo "SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69" >> ${DEST}/ca.crt
    echo "ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr" >> ${DEST}/ca.crt
    echo "AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz" >> ${DEST}/ca.crt
    echo "R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5" >> ${DEST}/ca.crt
    echo "JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo" >> ${DEST}/ca.crt
    echo "Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ" >> ${DEST}/ca.crt
    echo "-----END CERTIFICATE-----" >> ${DEST}/ca.crt
    cat ${SOURCE}/chain.pem >> ${DEST}/ca.crt
fi
openssl x509 -in ${DEST}/ca.crt -out ${DEST}/ca.pem -outform PEM
openssl verify -CAfile ${DEST}/ca.crt ${DEST}/mongodb.pem

/etc/mongod.conf:

ssl:
  mode: requireSSL
  PEMKeyFile: /etc/ssl/mongodb/mongodb.pem
  # do not add a CAFile:entry

Related Solutions

Ssl – MongoDB SSL encryption and Spring’s Driver

First, let me say that the MongoDB SSL docs are being worked on, most of the information here will be included there eventually, but until then.....

The Java driver, which I believe spring uses, does support SSL. In terms of getting mongoDB running with SSL, there are currently two options. First, you can become a subscriber and use the subscriber edition - that has SSL (and SNMP) support built in:

https://www.10gen.com/mongodb-subscriber-edition-download

As of writing this, it is very much a new offering and is only available for Amazon Linux and Ubuntu.

The second option, thanks to the fact that MongoDB is open source, is to build yourself a copy of mongoDB with SSL support. To do so, first I would recommend following the general build instructions until you succeed with a non-SSL build:

http://www.mongodb.org/display/DOCS/Building+for+Linux

Then build with the --ssl flag passed to scons to enable SSL. You will also likely have to install the required openssl libraries or the configure will fail dependencies check (generally libssl and libssl-dev).

Once you complete that step, you should be good to go. When running MongoDB with SSL enabled bear in mind that you have to connect with SSL for everything. All clients, the shell, the driver and MMS will all have to connect via SSL or fail. In order to start mongod with SSL you will need a cert, a key, the password and something like these options (in addition to any other options you want to pass):

mongod --sslOnNormalPorts --sslPEMKeyFile <pem> --sslPEMKeyPassword <pass>

You may also specify these option in a config file (usually /etc/mongodb.conf) like so:

sslOnNormalPorts = true
sslPEMKeyFile = /etc/ssl/mongodb.pem
sslPEMKeyPassword = pass

For the shell simply use

mongo --ssl --host <hostname> --port <port>

Finally, you mentioned using Java, here is an example "sslApp.java" class file:

import com.mongodb.*;
import javax.net.ssl.SSLContext;
public class sslApp {
public static void main(String args[])
throws Exception {
         MongoOptions o = new MongoOptions();
         o.socketFactory = SSLSocketFactory.getDefault();
         Mongo m = new Mongo( "localhost" , o );
         DB db = m.getDB( "test" );
         DBCollection c = db.getCollection( "foo" );
         System.out.println( c.findOne() );
} }

Mongodb cannot connect over network

If you need to use a nonstandard port you need to use the --port switch from the command line mongo <public ip> --port 27027

Best Answer

Related Solutions

Ssl – MongoDB SSL encryption and Spring’s Driver

Mongodb cannot connect over network

Related Topic