I am trying to follow these instructions to connect to MongoDB over SSL: https://gist.github.com/leommoore/1e773a7d230ca4bbe1c2
A minor change I made was to use certbot certonly instead of letsencrypt-auto certonly.
In my /etc/letsencrypt/live/redacted.exampledomain.com/
lrwxrwxrwx. 1 root root 51 Oct 19 05:42 cert.pem -> ../../archive/redacted.exampledomain.com/cert1.pem lrwxrwxrwx. 1 root root 52 Oct 19 05:42 chain.pem -> ../../archive/redacted.exampledomain.com/chain1.pem lrwxrwxrwx. 1 root root 56 Oct 19 05:42 fullchain.pem -> ../../archive/redacted.exampledomain.com/fullchain1.pem lrwxrwxrwx. 1 root root 54 Oct 19 05:42 privkey.pem -> ../../archive/redacted.exampledomain.com/privkey1.pem In my /etc/letsencrypt/archive/redacted.exampledomain.com/ directory I have:
-rw-r--r--. 1 root root 1830 Oct 19 05:42 cert1.pem -rw-r--r--. 1 root root 1647 Oct 19 05:42 chain1.pem -rw-r--r--. 1 root root 3477 Oct 19 05:42 fullchain1.pem -rw-r--r--. 1 root root 1704 Oct 19 05:42 privkey1.pem This is my script I am using to automate the process:
#!/bin/bash # from: https://gist.github.com/leommoore/1e773a7d230ca4bbe1c2 SOURCE=/etc/letsencrypt/live/redacted.exampledomain.com DEST=/etc/ssl/mongodb cat ${SOURCE}/privkey.pem ${SOURCE}/cert.pem > ${DEST}/mongodb.pem # (also tried this...) # cat ${SOURCE}/privkey.pem ${SOURCE}/fullchain.pem > ${DEST}/mongodb.pem if [ ! -e ${DEST}/ca.crt ] ; then # from: https://www.identrust.com/certificates/trustid/root-download-x3.html echo "-----BEGIN CERTIFICATE-----" > ${DEST}/ca.crt echo "MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/" >> ${DEST}/ca.crt echo "MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT" >> ${DEST}/ca.crt echo "DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow" >> ${DEST}/ca.crt echo "PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD" >> ${DEST}/ca.crt echo "Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB" >> ${DEST}/ca.crt echo "AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O" >> ${DEST}/ca.crt echo "rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq" >> ${DEST}/ca.crt echo "OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b" >> ${DEST}/ca.crt echo "xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw" >> ${DEST}/ca.crt echo "7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD" >> ${DEST}/ca.crt echo "aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV" >> ${DEST}/ca.crt echo "HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG" >> ${DEST}/ca.crt echo "SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69" >> ${DEST}/ca.crt echo "ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr" >> ${DEST}/ca.crt echo "AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz" >> ${DEST}/ca.crt echo "R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5" >> ${DEST}/ca.crt echo "JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo" >> ${DEST}/ca.crt echo "Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ" >> ${DEST}/ca.crt echo "-----END CERTIFICATE-----" >> ${DEST}/ca.crt cat ${SOURCE}/chain.pem >> ${DEST}/ca.crt # also tried fullchain.pem, did not work fi openssl x509 -in ${DEST}/ca.crt -out ${DEST}/ca.pem -outform PEM openssl verify -CAfile ${DEST}/ca.crt ${DEST}/mongodb.pem When I run it, it outputs: /etc/ssl/mongodb/mongodb.pem: OK
I have added these lines to /etc/mongod.conf:
ssl: mode: requireSSL PEMKeyFile: /etc/ssl/mongodb/mongodb.pem CAFile: /etc/ssl/mongodb/ca.pem Restarted the service.
I have copied the 2 .pem files to a remote host and am trying to connect remotely with this command:
mongo --ssl -sslCAFile ${HOME}/mongodb/ca.pem --sslPEMKeyFile ${HOME}/mongodb/mongodb.pem redacted.exampledomain.com:27017/testdb This is the error message I am getting:
2016-10-19T18:53:21.851-0700 E NETWORK [thread1] SSL peer certificate validation failed: unable to verify the first certificate 2016-10-19T18:53:21.852-0700 E QUERY [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: unable to verify the first certificate : connect@src/mongo/shell/mongo.js:231:14 @(connect):1:6 exception: connect failed What am I doing wrong? How can I fix this? My end goal is to migrate data from parse.com to my own server.
