Enabling ssl in mongodb replicaset without certificates - mongodb

Question

I am trying to set up a mongodb 2.6.8 replicaset using ssl. I compiled mongo manually with ssl support and enabled ssl in my configuration as follows:
sslMode=requireSSL
sslPEMKeyFile=/etc/ssl/mongodb.pem
sslCAFile=/etc/ssl/client.pem
sslWeakCertificateValidation=true
replSet=rs0
I created the mongodb.pem and client.pem files bu running openssl as follows on each server:
# openssl req -new -x509 -days 365 -nodes -out mongodb-cert.crt -keyout mongodb-cert.key -subj '/C=US/ST=MA/L=Waltham/CN=<fully qualified domain name>'
# cat mongodb-cert.key mongodb-cert.crt > mongodb.pem
# openssl req -new -x509 -days 365 -nodes -out client-cert.crt -keyout client-cert.key -subj '/C=US/ST=MA/L=Waltham/CN=<fully qualified domain name>'
# cat client-cert.key client-cert.crt > client.pem
On each server I can confirm that the certificates and ssl is working because on each of my servers I can do the following:
mongo --ssl --sslPEMKeyFile=/etc/ssl/client.pem --sslCAFile=/etc/ssl/mongodb.pem <fully qualified domain name>
drops me into the mongo shell.
On the primary node, I can do rs.initiate() and rs.status() and it looks fine:
> rs.initiate()
{
"info2" : "no configuration explicitly specified -- making one",
"me" : "<fqdn node 1>:27017",
"info" : "Config now saved locally. Should come online in about a minute.",
"ok" : 1
}
> rs.status()
{
"set" : "rs0",
"date" : ISODate("2015-04-02T20:25:27Z"),
"myState" : 1,
"members" : [
{
"_id" : 0,
"name" : "<fqdn node 1>:27017",
"health" : 1,
"state" : 1,
"stateStr" : "PRIMARY",
"uptime" : 23,
"optime" : Timestamp(1428006318, 1),
"optimeDate" : ISODate("2015-04-02T20:25:18Z"),
"electionTime" : Timestamp(1428006318, 2),
"electionDate" : ISODate("2015-04-02T20:25:18Z"),
"self" : true
}
],
"ok" : 1
}
However, when I attempt to add the second member, I get the dreaded 13144 error:
rs0:PRIMARY> rs.add("<fqdn node 2>:27017")
{
"errmsg" : "exception: need most members up to reconfigure, not ok : <fqdn node 2>:27017",
"code" : 13144,
"ok" : 0
}
I should also note that connecting between the two hosts works fine, i.e., while on node 1:
mongo --ssl --host <fqdn node 2>
or while on node 2:
mongo --ssl --host <fqdn node 1>
both work.
How do I pass in the ssl option and/or the certificates to the rs.add() command?
I don't actually care about passing the certificates (which is why I specified sslWeakCertificateValidation=true); I'm more concerned about making sure the communication between the nodes is in ssl.

Answer 1

It's difficult to be certain what was wrong, but I've got a few observations:
You may have got that error if the other mongod process was started without the replSet=rs0 item in its configuration
You may have got that error because the servers cannot communicate on port 27017, e.g. if a firewall is blocking them. It's worth verifying the connectivity by, on each server, connecting the mongo client to the other server.
There is a problem with your mongod.pem file. You have created it by concatenating the server's private key and certificate; but it should not contain the key. It should be just an ascending chain of certificates, starting with the server and ending with the root. If the server is self-certified, then there is no need to concatenate anything else.