Question

我们在Mongo Cloud Manager上设置了mongodb，这意味着他们是dns-hostnames所有者。对于SSL连接，我已为副本集中的所有服务器创建了自授权的自签名证书。当为parse-server提供mongo连接字符串时，我得到了这个：

错误：未捕获的内部服务器错误。 {[MongoError：证书链中的自签名证书] 名称：＆＃39; MongoError＆＃39;，消息：＆＃39;证书链中的自签名证书＆＃39;错误：证书链中的自签名证书在错误（本机）在TLSSocket。（_tls_wrap.js：1013：38）在emitNone（events.js：67：13）在TLSSocket.emit（events.js：166：7） at TLSSocket._init.ssl.onclienthello.ssl.oncertcb.TLSSocket._finishInit（_tls_wrap.js：582：8）在TLSWrap.TLSSocket._init.ssl.onclienthello.ssl.oncertcb.ssl.onnewsession.ssl.onhandshakedone(_tls_wrap.js:424:38）

我非常肯定（好吧，希望）如果我能以某种方式为Parse的mongodb客户端提供应该解决这些问题的自生根证书。问题是 - 是否可以为解析服务器提供mongodb SSL连接证书，如果可以 - 如何？

Answer 1

嗯，我最近习惯提供自己的答案，所以这是另一个。解决方案是正确获取/生成客户端证书，以便拥有client.crt和client.key，拥有根证书和任何中间证书，并设置replSet ssl设置。如下所示，我需要在'databaseOptions'中设置'replSet'。我在解析服务器上花了一些逆向工程。请注意，如果该区域中的解析服务器代码发生更改，则此解决方案将停止工作。

无论如何，来自parse-server-example的以下修改过的index.js帮助我解决了这个问题。我的补充是MONGODB_CERTIFICATE env变量。

// Example express application adding the parse-server module to expose Parse
// compatible API routes.

var express = require('express');
var ParseServer = require('parse-server').ParseServer;
var path = require('path');
var fs = require('fs');

var databaseUri = process.env.DATABASE_URI || process.env.MONGODB_URI;

if (!databaseUri) {
  console.log('DATABASE_URI not specified, falling back to localhost.');
}

var parseSettings = {
  databaseURI: databaseUri || 'mongodb://localhost:27017/dev',
  cloud: process.env.CLOUD_CODE_MAIN || __dirname + '/cloud/main.js',
  appId: process.env.APP_ID || 'myAppId',
  masterKey: process.env.MASTER_KEY || '', //Add your master key here. Keep it secret!
  serverURL: process.env.SERVER_URL || 'http://localhost:1337/parse',  // Don't forget to change to https if needed
  liveQuery: {
    classNames: ["Posts", "Comments"] // List of classes to support for query subscriptions
  }
}

// This allows to provide mongo client with certificates for mongodb replica set
// this is handy when you have your own self-authotized/signed certificates in mongo db
if (process.env.MONGODB_CRT_FOLDER) {
  // MONGODB_CRT_FOLDER - certificates folder e.g. /my/certificates
  // if the path is relative to the project just start it without  '/'
  // The folder is must contain 
  //   1. client.key (hard coded name)
  //   2. client.crt (hard coded name)
  //   3. one or more intermediate certificates and a root certificate for the certificate chain
  // MONGODB_CERTIFICATES - the names of the certificates in the certficate chain seperated by comma
  var crtFolder = process.env.MONGODB_CRT_FOLDER + '/';
  if (!process.env.MONGODB_CRT_FOLDER.startsWith('/'))  
    crtFolder = __dirname + '/' + crtFolder;

  var certificatesFiles = process.env.MONGODB_CERTIFICATES.split(',');
  var certificates = [];
  var i;
  for (i in certificatesFiles) {
    certificates.push(fs.readFileSync( crtFolder + '/' + certificatesFiles[i]))
  }

  parseSettings.databaseOptions = {
    replSet: {
      ssl: true,
      sslValidate: true,
      sslCA: certificates,
      sslCert: fs.readFileSync( crtFolder + 'client.crt'),
      sslKey: fs.readFileSync( crtFolder + 'client.key')
    }
  };
}


var api = new ParseServer(parseSettings);
// Client-keys like the javascript key or the .NET key are not necessary with parse-server
// If you wish you require them, you can set them as options in the initialization above:
// javascriptKey, restAPIKey, dotNetKey, clientKey

var app = express();

// Serve static assets from the /public folder
app.use('/public', express.static(path.join(__dirname, '/public')));

// Serve the Parse API on the /parse URL prefix
var mountPath = process.env.PARSE_MOUNT || '/parse';
app.use(mountPath, api);

// Parse Server plays nicely with the rest of your web routes
app.get('/', function(req, res) {
  res.status(200).send('Make sure to star the parse-server repo on GitHub!');
});

// There will be a test page available on the /test path of your server url
// Remove this before launching your app
app.get('/test', function(req, res) {
  res.sendFile(path.join(__dirname, '/public/test.html'));
});

var port = process.env.PORT || 1337;
var httpServer = require('http').createServer(app);
httpServer.listen(port, function() {
    console.log('parse-server-example running on port ' + port + '.');
});

// This will enable the Live Query real-time server
ParseServer.createLiveQueryServer(httpServer);

请注意，您必须安装ns --save'fs'和'path'。

parse-server：是否可以为mongodb连接提供根证书？

1 个答案: