I am trying to connect Cubejs to MongoDB through MongoDB BI Connect.
My mongosqld command is as follows
./mongosqld --config mongosqld.conf -u useradmin -p xxxx --auth --sslMode requireSSL --sslPEMKeyFile mongo.pem
I have created mongo.pem file by referring below link
Cube.js: Error: ssl is required when using cleartext authentication using MongoDB BI Connector
My Cube.js .ENV configuration is as follows
CUBEJS_DEV_MODE=true
CUBEJS_DB_TYPE=mongobi
CUBEJS_API_SECRET= xxxxxx
CUBEJS_EXTERNAL_DEFAULT=true
CUBEJS_SCHEDULED_REFRESH_DEFAULT=true
CUBEJS_WEB_SOCKETS=true
CUBEJS_DB_HOST=localhost
CUBEJS_DB_NAME=RDM
CUBEJS_DB_USER=useradmin
CUBEJS_DB_PASS=xxxx
CUBEJS_DB_SSL=true
CUBEJS_DB_SSL_REJECT_UNAUTHORIZED=false
After trying to connect Error shown in cubejs
Runtime Error
Cube.js was unable to connect to the specified database.
The database returned the following error:
>Database Error
Error: Error: 19488:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:c:\ws\deps\openssl\openssl\ssl\record\ssl3_record.c:332:
And below error in mongosqld run on powershell
2021-10-12T17:15:06.045+0000 I NETWORK [conn1] connection accepted from 127.0.0.1:61457 #1 (1 connection now open)
2021-10-12T17:15:06.056+0000 E NETWORK [conn1] handshake error: ERROR 1043 (08S01): recv handshake response error: ERROR 1043 (08S01): ssl configuration error: UseCertificateChainFile: SSL errors: 906d06c:PEM routines:PEM_read_bio:no start line
140dc009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib
2021-10-12T17:15:06.057+0000 I NETWORK [conn1] end connection 127.0.0.1:61457 (0 connections now open)
From the error I understand that the .pem file generated is not correct. Can someone please help me in this ?
I run MongoDB (version 4.4.1) this way:
mongod --dbpath /tmp/mongotest/1/db --logpath /tmp/mongotest/1/mongod.log --port 27017 --tlsMode requireTLS --tlsCertificateKeyFile /tmp/mongokeys/test-server1.pem --tlsCAFile /tmp/mongokeys/test-ca.pem --tlsAllowConnectionsWithoutCertificates
The test-server1.pem and test-ca.pem files have been generated following the example procedures (this and this) in official MongoDB documentation.
Now I try to connect using mongo shell (version 4.4.1) this way:
mongo --tls
It fails. This is the trace:
MongoDB shell version v4.4.1
connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
{"t":{"$date":"2021-03-01T13:18:54.768Z"},"s":"E", "c":"NETWORK", "id":23256, "ctx":"js","msg":"SSL peer certificate validation failed","attr":{"error":"SSL peer certificate validation failed: self signed certificate in certificate chain"}}
Error: couldn't connect to server 127.0.0.1:27017, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: self signed certificate in certificate chain :
connect#src/mongo/shell/mongo.js:374:17
#(connect):2:6
exception: connect failed
exiting with code 1
In addition, mongod log shows:
{"t":{"$date":"2021-03-01T14:19:40.397+01:00"},"s":"I", "c":"NETWORK", "id":22943, "ctx":"listener","msg":"Connection accepted","attr":{"remote":"127.0.0.1:38934","connectionId":15,"connectionCount":1}}
{"t":{"$date":"2021-03-01T14:19:40.415+01:00"},"s":"W", "c":"NETWORK", "id":23234, "ctx":"conn15","msg":"No SSL certificate provided by peer"}
{"t":{"$date":"2021-03-01T14:19:40.415+01:00"},"s":"I", "c":"NETWORK", "id":22944, "ctx":"conn15","msg":"Connection ended","attr":{"remote":"127.0.0.1:38934","connectionId":15,"connectionCount":0}}
What is surprising is the "No SSL certificate provided by peer" message. Of course, that's is true (I mean, mongo shell connection is not sending any certificate to the MongoDB server) but as far as I understand the --tlsAllowConnectionsWithoutCertificates should allow this kind of certificate-less connections.
Probably I'm doing something wrong, but I don't know what it is :) Any help is really welcomed!
Probably I'm doing something wrong, but I don't know what it is :)
You are experiencing the full informativeness of OpenSSL diagnostic messages.
The client and the server both validate the certificates of the other side, by default. You configured the server to not validate the client's certificate. The error is coming from the shell after it tries to validate the server's certificate and cannot follow the server cert to a known CA cert. This is reported as "self-signed certificate in certificate chain" which is true but misleading (the shell would be very capable of accepting the server's certificate if you gave it the CA cert which is self-signed).
The server log tells you the client hasn't provided the certificate, which is true and normal for your configuration, but the connection close is initiated by the client (shell). There isn't a server problem there. See also this and this.
I am trying to test a mongoDB installation with self signed certificates. I followed the instructions in the mongoDB documentation for creating the 'pem' files using the copy links on each page:
Appendix A - OpenSSL CA Certificate for Testing
Appendix B - OpenSSL Server Certificates for Testing
Appendix C - OpenSSL Client Certificates for Testing
I updated the /etc/mongod.conf as such:
# network interfaces
net:
port: 27017
bindIp: 0.0.0.0
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb/test-server1.pem
allowConnectionsWithoutCertificates: true
allowInvalidHostnames: true
allowInvalidCertificates: true
CAFile: /etc/ssl/mongodb/mongodb-test-ca.crt
Originally I did not have the 'allow' option, but they do not make a difference so I am leaving the in for now.
Running the mongodb shell results in this error:
root#ip-10-0-3-61:~/mongo-cert# mongo --tls --tlsCertificateKeyFile test-client.pem
MongoDB shell version v4.2.5
connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
2020-04-17T17:07:25.809+0000 E NETWORK [js] SSL peer certificate validation failed: self signed certificate in certificate chain
2020-04-17T17:07:25.810+0000 E QUERY [js] Error: couldn't connect to server 127.0.0.1:27017, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: self signed certificate in certificate chain :
connect#src/mongo/shell/mongo.js:341:17
#(connect):2:6
2020-04-17T17:07:25.812+0000 F - [main] exception: connect failed
2020-04-17T17:07:25.812+0000 E - [main] exiting with code 1
root#ip-10-0-3-61:~/mongo-cert#
If I add the '--tlsAllowInvalidCertificates' in the command it works:
root#ip-10-0-3-61:~/mongo-cert# mongo --tls --tlsCertificateKeyFile test-client.pem --tlsAllowInvalidCertificates
MongoDB shell version v4.2.5
connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
2020-04-17T17:09:18.934+0000 W NETWORK [js] SSL peer certificate validation failed: self signed certificate in certificate chain
Implicit session: session { "id" : UUID("3b0d0920-931d-4143-a8a2-afde432c1444") }
MongoDB server version: 4.2.5
>
I have read other people who have followed the mongodb instructions successfully.
I just do not understand what I have done wrong.
You need to provide the CA file to mongo also (the --tlsCAFile option), in addition to the client certificate.
When full verification is enabled with TLS both server and client validate the other's certificate. This means both must have access to the CA cert used for signing the leaf certs.
A little background...my certificate is a LetsEncrypt.org SSL certificate issued with Certbot. I'm running Nginx 1.12.2, and I'm able to properly access my website using https:// so I believe that portion is configured properly. My web server is running Ubuntu 16.04 and MongoDB 3.6.3.
I have tried many configurations and while I can connect to my MongoDB just fine using Compass (the official MongoDB GUI) without the SSL option, attempts to connect with SSL result in a Could not connect to MongoDB on the provided host and port error message. Running mongo -ssl --sslPEMKeyFile /etc/ssl/mongo.pem on my server results in the following error:
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27017
2018-06-12T16:51:10.756+0000 E NETWORK [thread1] SSL peer certificate validation failed: unable to get local issuer certificate
2018-06-12T16:51:10.757+0000 E QUERY [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: unable to get local issuer certificate :
connect#src/mongo/shell/mongo.js:251:13
#(connect):1:6
exception: connect failed
My /var/log/mongodb/mongod.log shows the following which corresponds to the error above:
2018-06-12T16:51:10.755+0000 I NETWORK [listener] connection accepted from 127.0.0.1:47792 #8 (2 connections now open)
2018-06-12T16:51:10.757+0000 I NETWORK [conn8] end connection 127.0.0.1:47792 (1 connection now open)
My /etc/mongod.conf contains the following (I've commented out the CAFile parameter as I've read this is optional for now [source: https://stackoverflow.com/a/33926129/2969615 ]; note that I get mongo.pem: OK when running the openssl verify -CAfile /etc/ca.pem /etc/mongo.pem command, so I believe mongo.pem is properly set up):
# network interfaces
net:
port: 27017
bindIp: 0.0.0.0
ssl:
mode: allowSSL
PEMKeyFile: /etc/ssl/mongo.pem
# CAFile: /etc/ssl/ca.pem
I've created my mongo.pem file by referring to the following: https://serverfault.com/a/878457 ...I have tried the certificate in the instructions as well as both X3 intermediate certificates available at https://letsencrypt.org/certificates/ to no avail.
Any help would be greatly appreciated.
Very late to the party, but just in case it does help someone. I am running mongodb inside docker with the official image from mongo and compass from another docker image.
For the server I use:
docker run -it --name data.domain.com --network docker_network -v /path/to/ssl:/ssl:ro -e MONGO_INITDB_ROOT_USERNAME=admin -e MONGO_INITDB_ROOT_PASSWORD=pass mongo --tlsMode requireTLS --tlsCertificateKeyFile /ssl/fullchain-key.pem --tlsCAFile /etc/ssl/certs/ISRG_Root_X1.pem
fullchain-key.pem is 'cat fullchain.pem privkey.pem > fullchain-key.pem'
docker name or server name must match certificate name
For Compass I use:
The server has it's own certificate and compass as well.
This is what I did exactly for establishing SSL connection.
1 Use openssl to generate a client and a server key (c.pem, s.pem)
2 Use openssl to generate a client key request and server key request
3 Get CA to sign both req and get the certs: c.cer , s.cer
4 concatenate c.pem and c.cer and get client.pem, similarly, get server.pem
Now start the server:
mongod --sslMode requireSSL --sslPEMKeyFile server.pem -sslCAFile caroot.cer
start the client:
mongo --ssl --sslCAFile caroot.cer --sslPEMKeyFile client.pem
And now I am getting the error:
E NETWORK SSL peer certificate validation failed:certificate not trusted
Any thoughts on why this doesn't work?