Adding TSL To Mongo causes it to crash - mongodb

Question

I have a 3 mongodb replication architecture up and running. When I add TSL to the /etc/mongod conf file mongod it crashes right away and writes nothing to mongo log. I put the pem file containing all the certs and key in /etc/ssl/mongo.pem with the key at the bottom of the file. I did a chmod 600 on the pem file. I am adding TSL to the primary first and stopping and starting mongod. My mongod TLS config:
net:
port: 27017
bindIpAll: true
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongo.pem
security:
keyFile: /opt/mongod/keyfile
The error I get when starting:
ec2-user#ip-10-0-16-140 log]$ sudo service mongod start
Starting mongod (via systemctl): Job for mongod.service failed because the control process exited with error code. See "systemctl status mongod.service" and "journalctl -xe" for details.
[FAILED]
The return from the status call:
[ec2-user#ip-10-0-16-140 ~]$ systemctl status mongod.service
● mongod.service - SYSV: Mongo is a scalable, document-oriented database.
Loaded: loaded (/etc/rc.d/init.d/mongod; bad; vendor preset: disabled)
Active: failed (Result: exit-code) since Fri 2020-02-28 00:43:51 UTC; 17s ago
Docs: man:systemd-sysv-generator(8)
Process: 18327 ExecStop=/etc/rc.d/init.d/mongod stop (code=exited, status=0/SUCCESS)
Process: 18548 ExecStart=/etc/rc.d/init.d/mongod start (code=exited, status=1/FAILURE)
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Starting SYSV: Mongo is a scalable, document-oriented database....
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal runuser[18559]: pam_unix(runuser:session): session opened for user mongod by (uid=0)
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal runuser[18559]: pam_unix(runuser:session): session closed for user mongod
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal mongod[18548]: Starting mongod: [FAILED]
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: mongod.service: control process exited, code=exited status=1
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Failed to start SYSV: Mongo is a scalable, document-oriented database..
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Unit mongod.service entered failed state.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: mongod.service failed.
[ec2-user#ip-10-0-16-140 ~]$ journalctl -xe
Feb 28 00:42:13 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18523]: pam_unix(sudo:session): session closed for user root
Feb 28 00:42:27 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18525]: ec2-user : TTY=pts/0 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/bin/vi /etc/mongo.pem
Feb 28 00:42:27 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18525]: pam_unix(sudo:session): session opened for user root by ec2-user(uid=0)
Feb 28 00:42:31 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18525]: pam_unix(sudo:session): session closed for user root
Feb 28 00:42:38 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18527]: ec2-user : TTY=pts/0 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/bin/vi /etc/ssl/mongo.pem
Feb 28 00:42:38 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18527]: pam_unix(sudo:session): session opened for user root by ec2-user(uid=0)
Feb 28 00:43:38 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18527]: pam_unix(sudo:session): session closed for user root
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18529]: ec2-user : TTY=pts/0 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/sbin/service mongod start
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18529]: pam_unix(sudo:session): session opened for user root by ec2-user(uid=0)
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Starting SYSV: Mongo is a scalable, document-oriented database....
-- Subject: Unit mongod.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit mongod.service has begun starting up.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal runuser[18559]: pam_unix(runuser:session): session opened for user mongod by (uid=0)
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal runuser[18559]: pam_unix(runuser:session): session closed for user mongod
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal mongod[18548]: Starting mongod: [FAILED]
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: mongod.service: control process exited, code=exited status=1
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Failed to start SYSV: Mongo is a scalable, document-oriented database..
-- Subject: Unit mongod.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit mongod.service has failed.
--
-- The result is failed.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: Unit mongod.service entered failed state.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal systemd[1]: mongod.service failed.
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal sudo[18529]: pam_unix(sudo:session): session closed for user root
Feb 28 00:43:51 ip-10-0-16-140.us-gov-east-1.compute.internal dhclient[2603]: XMT: Solicit on eth0, interval 113300ms.

Answer 1

It can be an issue with your mongodb.pem file. For testing purposes, you can create a self-signed certificate and key like this:
openssl req -newkey rsa:2048 -new -x509 -days 365 -nodes -out mongodb-cert.crt -keyout mongodb-cert.key
cat mongodb-cert.key mongodb-cert.crt > mongodb.pem
and then set the permissions on the PEM file, you can use
chmod 600 mongodb.pem
consider the following configuration file for a mongod instance:
net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
systemLog:
destination: file
path: "/var/log/mongodb/mongod.log"
logAppend: true
storage:
dbPath: "/var/lib/mongodb"
processManagement:
fork: true
net:
bindIp: 0.0.0.0
port: 27017
Note: bindIP with 0.0.0.0 is not best practice, but it good place to start
Also, you may find logs in /var/log/mongodb/mongod.log as the default path