MongoError：证书链中的自签名证书

Question

我正在尝试将我的节点服务器与 mongodb 连接并启用 ssl 选项。

mongod.conf

storage:
  dbPath: /var/lib/mongodb
  journal:
  enabled: true

# where to write logging data.
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log

# network interfaces
net:
  port: XX
  bindIp: 127.0.0.1,XXX.XX.XX.XXX
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/PEMKEYFILE.pem
    PEMKeyPassword: "PASSWORDFORPEM"
    CAFile: /etc/ssl/CAFILE.pem

security:
  authorization: enabled

replication:
  oplogSizeMB: 1024
  replSetName: "REPLSET"

节点服务器conf文件

MONGO_URL: '<pathToMongoDb>/<db>',
        MONGO_REPLICA_SET_READ_PREFERENCE: 'nearest',
        MONGO_REPLICA_SET: {
            ssl: true,
            sslValidate: true,
            sslKey: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCert: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCa: fs.readFileSync('/etc/ssl/CAFILE.pem'),
            replicaSet: 'REPLSET',
            auto_reconnect: false,
            poolSize: 24,
            socketOptions: {
                keepAlive: 1000,
                connectTimeoutMS: 30000
            }
        },
        MONGO_SERVER: {
            ssl: true,
            sslValidate: false,
            checkServerIdentity: false,
            sslKey: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCert: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCA: fs.readFileSync('/etc/ssl/CAFILE.pem'),
            poolSize: 24,
            socketOptions: { keepAlive: 300000, connectTimeoutMS: 30000 },
            reconnectTries: Number.MAX_VALUE,
            reconnectInterval: 1000
        },
        MONGO_CHECK_SERVER_IDENTITY: false,

猫鼬文件

mongoose.connect(config.MONGO_URL,{
  db: {
      native_parser: true,
      readPreference: config.MONGO_REPLICA_SET_READ_PREFERENCE
  },
  server: config.MONGO_SERVER,
  replset: config.MONGO_REPLICA_SET,
  user: config.MONGO_USER,
  pass: config.MONGO_PASSWORD,
  auth: {
      authdb: config.MONGO_AUTHDB
  }

})

I have created the CA certificate and and signing certificate but the node server is returning me with the error : MongoError: failed to connect to server [XX.XXX.XXX.XX:port] on first connect MongoError: self signed certificate in certificate chain I am able to connect to the mongo using shell using the following command

mongo XX.XX.XX.XXX:XX/<db> -u <user> -p <pass> --authenticationDatabase=admin --ssl --sslPEMKeyFile=/etc/ssl/PEMKEYFILE.pem --sslCAFile /etc/ssl/CAFILE.pem --sslAllowInvalidHostnames

Please suggest me where I am going wrong. Thanks

Answer 1

当您拥有自签名 CA 时，会发生此特定错误。

使用 mongo 3.3.4 驱动程序，它可以为我连接

var userName = encodeURIComponent("emailAddress=myemail@example.com,CN=notsameasca,OU=notsameasca,O=my.fqdn.com,L=HomeCity,ST=HomeState,C=XX");
const MongoDBURI = `mongodb://${userName}@dev.vm:27017?authMechanism=MONGODB-X509&tls=true`;


MongoClient.connect(url,{
        tlsAllowInvalidHostnames: true,
        tlsAllowInvalidCertificates: true,
        tlsCertificateKeyFile: "./ssl/keyandcert.pem",
      })

从命令行连接到服务器时，除非您使用--tlsAllowInvalidCertificates开关，否则也会发生这种情况。

mongo -port 27017 --tls --tlsCertificateKeyFile mongoadmin.pem --tlsAllowInvalidCertificates

您需要--tlsAllowInvalidCertificates在客户端连接中指定。

这一切都很难做到正确，祝你好运......你会需要它。