Connection attempt failed : Socket Exception - MongoDB TLS encryption on Ubuntu 16.04 - mongodb

Question

I am facing this error on my ubuntu 16.04 machine while trying to encrypt data from the client to the server using TLS/SSL on Mongodb:
As requested, here is my command in text format :
mongo --tls --tlsCAFile rootCA.pem --tlsCertificateKeyFile mongodb.pem --host 127.0.0.1:27017
I have created a CA certificate which I have self-signed, and created the mongodb.pem file too as it is required for tls/ssl encryption.
Does anybody know how to fix it ? If you need more info I would gladly provide them.
This is my mongodb.conf file :
mongod.conf
# for documentation of all options, see:
# http://docs.mongodb.org/manual/reference/configuration-options/
# Where and how to store data.
storage:
dbPath: /var/lib/mongodb
journal:
enabled: true
# engine:
# mmapv1:
# wiredTiger:
# where to write logging data.
systemLog:
destination: file
logAppend: true
path: /var/log/mongodb/mongod.log
# network interfaces
net:
port: 27017
bindIp: 127.0.0.1
tls :
mode : requireTLS
certificateKeyFile : /home/youssef/mongodb.pem
# how the process runs
processManagement:
timeZoneInfo: /usr/share/zoneinfo
#security:
#operationProfiling:
#replication:
#sharding:
## Enterprise-Only Options:
#auditLog:
#snmp:
And I used this method to create a user :
db.createUser( { user: "accountAdmin01",
pwd: "password", // Or "<cleartext password>
roles: [ { role: "clusterAdmin", db: "admin" }])
This is the error I get from the logs :
"msg":"Error receiving request from client. Ending connection from remote","attr":{"error":{"code":141,"codeName":"SSLHandshakeFailed","errmsg":"SSL handshake received but server is started without SSL support"},"remote":"127.0.0.1:34766","connectionId":4}}
And just in case you are wondering where I got the rootCA.pem and mongodb.pem files, I just went through this tutorial : https://rajanmaharjan.medium.com/secure-your-mongodb-connections-ssl-tls-92e2addb3c89

Answer 1

According to your config file and createUser you use the TLS/SSL certificate only to encrypt the connection. In this case skip --tlsCertificateKeyFile mongodb.pem option.
The MongoDB server provides the certificate (mongodb.pem), the client has to verify this certificate by using the CA rootCA.pem
If you like to use --tlsCertificateKeyFile, then you must specify the CAFile in mongodb.conf. Otherwise the MongoDB server cannot verify the certificate provided from the client:
net:
port: 27017
bindIp: 127.0.0.1
tls :
mode : requireTLS
certificateKeyFile : /home/youssef/mongodb.pem
CAFile: /etc/ssl/rootCA.pem
allowConnectionsWithoutCertificates: true # if you like to permit connections with and without certificate
Note, try openssl verify -CAfile rootCA.pem mongodb.pem in order to check if your certificate is working and valid.