如何修复 mongo 中的 SSL 错误“CSSMERR_TP_VERIFY_ACTION_FAILED”？

Question

我看到此错误消息，每当我试图使用SSL连接的标志--ssl，--sslAllowInvalidHostnames以及--sslCAFile：

MongoDB shell version v4.0.10
connecting to: mongodb://<redacted>
2019-07-01T14:47:17.420-0700 D NETWORK  [js] creating new connection to:<redacted>
2019-07-01T14:47:17.687-0700 E NETWORK  [js] SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected
2019-07-01T14:47:17.687-0700 D -        [js] User Assertion: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected src/mongo/transport/session_asio.h 242
2019-07-01T14:47:17.687-0700 D -        [js] User Assertion: InternalError: couldn't connect to server <redacted>, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected src/mongo/scripting/mozjs/mongo.cpp 757
2019-07-01T14:47:17.687-0700 E QUERY    [js] Error: couldn't connect to server <redacted>, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected :
connect@src/mongo/shell/mongo.js:344:17
@(connect):2:6
2019-07-01T14:47:17.687-0700 D -        [js] User Assertion: Location12513: connect failed src/mongo/shell/shell_utils.cpp 344
2019-07-01T14:47:17.687-0700 I QUERY    [js] MozJS GC prologue heap stats -  total: 3664180 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY    [js] MozJS GC epilogue heap stats -  total: 2620 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY    [js] MozJS GC prologue heap stats -  total: 4916 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY    [js] MozJS GC epilogue heap stats -  total: 12 limit: 0
2019-07-01T14:47:17.690-0700 D -        [main] User Assertion: Location12513: connect failed src/mongo/scripting/mozjs/proxyscope.cpp 302
exception: connect failed

我已经验证了以下内容：

• 我的 SSL 证书是最新的并确认是正确的
• 我的 SSL 版本是 1.0.2s
• 我的mongo版本更新到v4.0.10
• 我使用的是 MacOS X 10.14.5

这似乎是一个与 Apple 相关的问题，因为有关失败消息的唯一参考在https://developer.apple.com/documentation/security/1396762-cmsdecodercopysignerstatus?language=objc中列出

我还能检查什么来解决这个问题CSSMERR_TP_VERIFY_ACTION_FAILED？

预期使用 SSL 证书连接到数据库。

Answer 1

能够通过将我的 mongo shell 版本降级到 3.6.8 来解决这个问题，对于任何遇到相同问题的人来说，是 mac 上的 v4 mongo shell 导致了这个问题。