MongoError：证书链中的自签名证书

Question

我正在尝试使用启用了ssl选项的mongodb连接我的节点服务器。

mongod.conf

storage:
  dbPath: /var/lib/mongodb
  journal:
  enabled: true

# where to write logging data.
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log

# network interfaces
net:
  port: XX
  bindIp: 127.0.0.1,XXX.XX.XX.XXX
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/PEMKEYFILE.pem
    PEMKeyPassword: "PASSWORDFORPEM"
    CAFile: /etc/ssl/CAFILE.pem

security:
  authorization: enabled

replication:
  oplogSizeMB: 1024
  replSetName: "REPLSET"

节点服务器配置文件

MONGO_URL: '<pathToMongoDb>/<db>',
        MONGO_REPLICA_SET_READ_PREFERENCE: 'nearest',
        MONGO_REPLICA_SET: {
            ssl: true,
            sslValidate: true,
            sslKey: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCert: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCa: fs.readFileSync('/etc/ssl/CAFILE.pem'),
            replicaSet: 'REPLSET',
            auto_reconnect: false,
            poolSize: 24,
            socketOptions: {
                keepAlive: 1000,
                connectTimeoutMS: 30000
            }
        },
        MONGO_SERVER: {
            ssl: true,
            sslValidate: false,
            checkServerIdentity: false,
            sslKey: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCert: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCA: fs.readFileSync('/etc/ssl/CAFILE.pem'),
            poolSize: 24,
            socketOptions: { keepAlive: 300000, connectTimeoutMS: 30000 },
            reconnectTries: Number.MAX_VALUE,
            reconnectInterval: 1000
        },
        MONGO_CHECK_SERVER_IDENTITY: false,

mongoose文件

mongoose.connect(config.MONGO_URL,{
  db: {
      native_parser: true,
      readPreference: config.MONGO_REPLICA_SET_READ_PREFERENCE
  },
  server: config.MONGO_SERVER,
  replset: config.MONGO_REPLICA_SET,
  user: config.MONGO_USER,
  pass: config.MONGO_PASSWORD,
  auth: {
      authdb: config.MONGO_AUTHDB
  }

}）

我已经创建了CA证书和签名证书，但节点服务器正在返回错误：MongoError: failed to connect to server [XX.XXX.XXX.XX:port] on first connect MongoError: self signed certificate in certificate chain我可以使用shell使用以下命令连接到mongo

mongo XX.XX.XX.XXX:XX/<db> -u <user> -p <pass> --authenticationDatabase=admin --ssl --sslPEMKeyFile=/etc/ssl/PEMKEYFILE.pem --sslCAFile /etc/ssl/CAFILE.pem --sslAllowInvalidHostnames

请建议我哪里出错了。感谢

Answer 1

当您具有自签名的CA时，会发生此特定错误。

通过mongo 3.3.4驱动程序，它可以通过

为我连接

var userName = encodeURIComponent("emailAddress=myemail@example.com,CN=notsameasca,OU=notsameasca,O=my.fqdn.com,L=HomeCity,ST=HomeState,C=XX");
const MongoDBURI = `mongodb://${userName}@dev.vm:27017?authMechanism=MONGODB-X509&tls=true`;


MongoClient.connect(url,{
        tlsAllowInvalidHostnames: true,
        tlsAllowInvalidCertificates: true,
        tlsCertificateKeyFile: "./ssl/keyandcert.pem",
      })

从命令行连接到服务器时，除非您使用--tlsAllowInvalidCertificates开关，否则也会发生。

mongo -port 27017 --tls --tlsCertificateKeyFile mongoadmin.pem --tlsAllowInvalidCertificates

您需要在客户端连接中指定--tlsAllowInvalidCertificates。

这一切都很棘手，祝您好运……您将需要它。