☰

无法通过 SSL 连接到 MongoDb

tag-icon • tag-icon ssl mongodb parse-server
无法通过 SSL 连接到 MongoDb

我正在尝试按照以下说明通过 SSL 连接到 MongoDB： https://gist.github.com/leommoore/1e773a7d230ca4bbe1c2

我做的一个小改动是使用certbot certonly而不是letsencrypt-auto certonly。

在我的 /etc/letsencrypt/live/redacted.exampledomain.com/

lrwxrwxrwx. 1 root root 51 Oct 19 05:42 cert.pem -> ../../archive/redacted.exampledomain.com/cert1.pem
lrwxrwxrwx. 1 root root 52 Oct 19 05:42 chain.pem -> ../../archive/redacted.exampledomain.com/chain1.pem
lrwxrwxrwx. 1 root root 56 Oct 19 05:42 fullchain.pem -> ../../archive/redacted.exampledomain.com/fullchain1.pem
lrwxrwxrwx. 1 root root 54 Oct 19 05:42 privkey.pem -> ../../archive/redacted.exampledomain.com/privkey1.pem

在我的 /etc/letsencrypt/archive/redacted.exampledomain.com/ 目录中我有：

-rw-r--r--. 1 root root 1830 Oct 19 05:42 cert1.pem
-rw-r--r--. 1 root root 1647 Oct 19 05:42 chain1.pem
-rw-r--r--. 1 root root 3477 Oct 19 05:42 fullchain1.pem
-rw-r--r--. 1 root root 1704 Oct 19 05:42 privkey1.pem

这是我用来自动化该过程的脚本：

#!/bin/bash
# from: https://gist.github.com/leommoore/1e773a7d230ca4bbe1c2
SOURCE=/etc/letsencrypt/live/redacted.exampledomain.com
DEST=/etc/ssl/mongodb
cat ${SOURCE}/privkey.pem ${SOURCE}/cert.pem > ${DEST}/mongodb.pem
# (also tried this...)
# cat ${SOURCE}/privkey.pem ${SOURCE}/fullchain.pem > ${DEST}/mongodb.pem

if [ ! -e ${DEST}/ca.crt ] ; then
    # from: https://www.identrust.com/certificates/trustid/root-download-x3.html
    echo "-----BEGIN CERTIFICATE-----" > ${DEST}/ca.crt
    echo "MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/" >> ${DEST}/ca.crt
    echo "MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT" >> ${DEST}/ca.crt
    echo "DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow" >> ${DEST}/ca.crt
    echo "PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD" >> ${DEST}/ca.crt
    echo "Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB" >> ${DEST}/ca.crt
    echo "AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O" >> ${DEST}/ca.crt
    echo "rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq" >> ${DEST}/ca.crt
    echo "OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b" >> ${DEST}/ca.crt
    echo "xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw" >> ${DEST}/ca.crt
    echo "7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD" >> ${DEST}/ca.crt
    echo "aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV" >> ${DEST}/ca.crt
    echo "HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG" >> ${DEST}/ca.crt
    echo "SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69" >> ${DEST}/ca.crt
    echo "ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr" >> ${DEST}/ca.crt
    echo "AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz" >> ${DEST}/ca.crt
    echo "R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5" >> ${DEST}/ca.crt
    echo "JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo" >> ${DEST}/ca.crt
    echo "Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ" >> ${DEST}/ca.crt
    echo "-----END CERTIFICATE-----" >> ${DEST}/ca.crt
    cat ${SOURCE}/chain.pem >> ${DEST}/ca.crt # also tried fullchain.pem, did not work
fi
openssl x509 -in ${DEST}/ca.crt -out ${DEST}/ca.pem -outform PEM
openssl verify -CAfile ${DEST}/ca.crt ${DEST}/mongodb.pem

当我运行它时，它输出：/etc/ssl/mongodb/mongodb.pem: OK

我已将这些行添加到/etc/mongod.conf：

ssl:
  mode: requireSSL
  PEMKeyFile: /etc/ssl/mongodb/mongodb.pem
  CAFile:     /etc/ssl/mongodb/ca.pem

已重新启动服务。

我已将 2 个 .pem 文件复制到远程主机，并尝试使用此命令进行远程连接：

mongo --ssl -sslCAFile ${HOME}/mongodb/ca.pem --sslPEMKeyFile ${HOME}/mongodb/mongodb.pem redacted.exampledomain.com:27017/testdb

这是我收到的错误消息：

2016-10-19T18:53:21.851-0700 E NETWORK  [thread1] SSL peer certificate validation failed: unable to verify the first certificate
2016-10-19T18:53:21.852-0700 E QUERY    [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: unable to verify the first certificate :
connect@src/mongo/shell/mongo.js:231:14
@(connect):1:6

exception: connect failed

我做错了什么？我该如何解决这个问题？我的最终目标是将数据迁移到parse.com我自己的服务器。

答案1

现在这与以下组合相关：

  • 在 shell 脚本中，使用 fullchain.pem 而不是 cert.pem
  • 在mongod.conf，不包括CAFile:一行

安装脚本：

#!/bin/bash
# from: https://gist.github.com/leommoore/1e773a7d230ca4bbe1c2
SOURCE=/etc/letsencrypt/live/redacted.exampledomain.com
DEST=/etc/ssl/mongodb
# use fullchain.pem instead of cert.pem
# cat ${SOURCE}/privkey.pem ${SOURCE}/fullchain.pem > ${DEST}/mongodb.pem

if [ ! -e ${DEST}/ca.crt ] ; then
    # from: https://www.identrust.com/certificates/trustid/root-download-x3.html
    echo "-----BEGIN CERTIFICATE-----" > ${DEST}/ca.crt
    echo "MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/" >> ${DEST}/ca.crt
    echo "MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT" >> ${DEST}/ca.crt
    echo "DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow" >> ${DEST}/ca.crt
    echo "PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD" >> ${DEST}/ca.crt
    echo "Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB" >> ${DEST}/ca.crt
    echo "AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O" >> ${DEST}/ca.crt
    echo "rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq" >> ${DEST}/ca.crt
    echo "OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b" >> ${DEST}/ca.crt
    echo "xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw" >> ${DEST}/ca.crt
    echo "7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD" >> ${DEST}/ca.crt
    echo "aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV" >> ${DEST}/ca.crt
    echo "HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG" >> ${DEST}/ca.crt
    echo "SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69" >> ${DEST}/ca.crt
    echo "ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr" >> ${DEST}/ca.crt
    echo "AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz" >> ${DEST}/ca.crt
    echo "R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5" >> ${DEST}/ca.crt
    echo "JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo" >> ${DEST}/ca.crt
    echo "Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ" >> ${DEST}/ca.crt
    echo "-----END CERTIFICATE-----" >> ${DEST}/ca.crt
    cat ${SOURCE}/chain.pem >> ${DEST}/ca.crt
fi
openssl x509 -in ${DEST}/ca.crt -out ${DEST}/ca.pem -outform PEM
openssl verify -CAfile ${DEST}/ca.crt ${DEST}/mongodb.pem

/etc/mongod.conf：

ssl:
  mode: requireSSL
  PEMKeyFile: /etc/ssl/mongodb/mongodb.pem
  # do not add a CAFile:entry

相关内容