MongoDB自签名SSL连接:SSL对等证书验证失败 [英] MongoDB Self-signed SSL connection: SSL peer certificate validation failed
问题描述
我已遵循本指南使用PyMongo进行的自签名SSL连接，作者是Wan Bachtiar 创建三个.pem文件； server.pem，client.pem和ca.pem.
我正在使用Ubuntu 16.04和MongoDB v3.2.11.
目的是在将MongoDB开放到公共互联网之前对其进行保护.
让蒙哥开始行动:
$ mongod --auth --port 27017 --dbpath /data/db1
--sslMode requireSSL --sslPEMKeyFile /etc/ssl/server.pem
--sslCAFile /etc/ssl/ca.pem --sslAllowInvalidHostnames &
输出:
root@tim:/etc/ssl# 2017-01-13T12:58:55.150+0000 I CONTROL [initandlisten] MongoDB starting : pid=19058 port=27017 dbpath=/data/db1 64-bit host=tim
2017-01-13T12:58:55.150+0000 I CONTROL [initandlisten] db version v3.2.11
2017-01-13T12:58:55.151+0000 I CONTROL [initandlisten] git version: 009580ad490190ba33d1c6253ebd8d91808923e4
2017-01-13T12:58:55.151+0000 I CONTROL [initandlisten] OpenSSL version: OpenSSL 1.0.2g 1 Mar 2016
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] allocator: tcmalloc
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] modules: none
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] build environment:
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] distmod: ubuntu1604
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] distarch: x86_64
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] target_arch: x86_64
2017-01-13T12:58:55.153+0000 I CONTROL [initandlisten] options: { net: { port: 27017, ssl: { CAFile: "/etc/ssl/ca.pem", PEMKeyFile: "/etc/ssl/server.pem", allowInvalidHostnames: true, mode: "requireSSL" }
}, security: { authorization: "enabled" }, storage: { dbPath: "/data/db1" } }
2017-01-13T12:58:55.211+0000 I - [initandlisten] Detected data files in /data/db1 created by the 'wiredTiger' storage engine, so setting the active storage engine to 'wiredTiger'.
2017-01-13T12:58:55.212+0000 W - [initandlisten] Detected unclean shutdown - /data/db1/mongod.lock is not empty.
2017-01-13T12:58:55.212+0000 W STORAGE [initandlisten] Recovering data from the last clean checkpoint.
2017-01-13T12:58:55.212+0000 I STORAGE [initandlisten] wiredtiger_open config: create,cache_size=1G,session_max=20000,eviction=(threads_max=4)
,config_base=false,statistics=(fast),log=(enabled=true,archive=true,path=journal,compressor=snappy),file_manager=(close_idle_time=100000),checkpoint=(wait=60,log_size=2GB),statistics_log=(wait=0),
2017-01-13T12:58:55.886+0000 I CONTROL [initandlisten] ** WARNING: You are running this process as the root user, which is not recommended.
2017-01-13T12:58:55.886+0000 I CONTROL [initandlisten]
2017-01-13T12:58:55.895+0000 I FTDC [initandlisten] Initializing full-time diagnostic data capture with directory '/data/db1/diagnostic.data'
2017-01-13T12:58:55.897+0000 I NETWORK [initandlisten] waiting for connections on port 27017 ssl
2017-01-13T12:58:55.897+0000 I NETWORK [HostnameCanonicalizationWorker] Starting hostname canonicalization worker
2017-01-13T12:58:56.026+0000 I FTDC [ftdc] Unclean full-time diagnostic data capture shutdown detected, found interim file, some metrics may have been lost. OK
运行mongod之后，我启动mongo shell:
$ mongo --port 27017 -u "my username" -p "my password"
--authenticationDatabase "" --ssl --sslPEMKeyFile /etc/ssl/client.pem
--sslCAFile /etc/ssl/ca.pem --host tim
输出类似于 Marshall Farrier的问题；让我们看看.
MongoDB shell version: 3.2.11
connecting to: 127.0.0.1:27017/datatest
2017-01-13T12:35:58.247+0000 I NETWORK [initandlisten] connection accepted from 127.0.0.1:38902 #8 (1 connection now open)
2017-01-13T12:35:58.259+0000 E NETWORK [thread1] SSL peer certificate validation failed: self signed certificate
2017-01-13T12:35:58.259+0000 E QUERY [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: self signed certificate :
connect@src/mongo/shell/mongo.js:231:14
@(connect):1:6
2017-01-13T12:35:58.263+0000 E NETWORK [conn8] SSL peer certificate validation failed: self signed certificate
2017-01-13T12:35:58.263+0000 I NETWORK [conn8] end connection 127.0.0.1:38902 (0 connections now open)
我在做什么错了?
经过一些搜索，似乎此错误是由于主机名"CN"不正确引起的.
来自 digitalocean :
无论何时生成CSR，都会提示您提供有关证书的信息.此信息称为专有名称(DN). DN中的一个重要字段是公用名(CN)，它应该是要与证书一起使用的主机的确切完全限定域名(FQDN).
也来自MongoDB 文档:
如果您的MongoDB部署使用SSL，则还必须指定--host选项. mongo验证您要连接的mongod的主机名是否与mongod或mongos的--sslPEMKeyFile证书的CN或SAN相匹配.如果主机名与CN/SAN不匹配，则mongo将无法连接.
解决方案:
我重新生成了密钥，用CN =< 主机名>中的任何其他主机名替换了localhost并完成了指南 注意:
MongoDB严格规定了谁有权访问哪个数据库，这是对mongo shell的快速测试: >显示数据库 返回错误.但是，我的用户实际上只能访问< 我的数据库>"中指定的数据库，因此循环浏览< 我的数据库>"中的行是完美的 I have followed this guide Self-signed SSL connection using PyMongo, by Wan Bachtiar to create three .pem files; server.pem, client.pem and ca.pem. I am using Ubuntu 16.04 and MongoDB v3.2.11. The purpose is to secure the MongoDB before opening it to the public internet. lets start the mongod: Output: After running the mongod, I start the mongo shell: The output is similar to the question by Marshall Farrier; lets have a look. What am I doing wrong? After some searching, it seems like this error is due to the fact that the hostname "CN" was incorrect. From digitalocean: Whenever you generate a CSR, you will be prompted to provide information regarding the certificate. This information is known as a Distinguised Name (DN). An important field in the DN is the Common Name (CN), which should be the exact Fully Qualified Domain Name (FQDN) of the host that you intend to use the certificate with. Also from MongoDB documentation: If your MongoDB deployment uses SSL, you must also specify the --host option. mongo verifies that the hostname of the mongod or mongos to which you are connecting matches the CN or SAN of the mongod or mongos‘s --sslPEMKeyFile certificate. If the hostname does not match the CN/SAN, mongo will fail to connect. SOLUTION: I regenerated the keys, replaced localhost with any other hostname in the CN = <hostname> and completed the guide by Wan Bachtiar. Running the following command after completion worked: Note:
The MongoDB folows a strict ruling of who has access to what db, a quick test in the mongo shell: > show dbs return an error. However, my user actually only have access to the db specified in "<my db>", so looping through the rows in "<my db>" works perfectly. 这篇关于MongoDB自签名SSL连接:SSL对等证书验证失败的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
$ mongod --auth --port 27017 --dbpath /data/db1
--sslMode requireSSL --sslPEMKeyFile /etc/ssl/server.pem
--sslCAFile /etc/ssl/ca.pem --sslAllowInvalidHostnames &
root@tim:/etc/ssl# 2017-01-13T12:58:55.150+0000 I CONTROL [initandlisten] MongoDB starting : pid=19058 port=27017 dbpath=/data/db1 64-bit host=tim
2017-01-13T12:58:55.150+0000 I CONTROL [initandlisten] db version v3.2.11
2017-01-13T12:58:55.151+0000 I CONTROL [initandlisten] git version: 009580ad490190ba33d1c6253ebd8d91808923e4
2017-01-13T12:58:55.151+0000 I CONTROL [initandlisten] OpenSSL version: OpenSSL 1.0.2g 1 Mar 2016
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] allocator: tcmalloc
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] modules: none
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] build environment:
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] distmod: ubuntu1604
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] distarch: x86_64
2017-01-13T12:58:55.152+0000 I CONTROL [initandlisten] target_arch: x86_64
2017-01-13T12:58:55.153+0000 I CONTROL [initandlisten] options: { net: { port: 27017, ssl: { CAFile: "/etc/ssl/ca.pem", PEMKeyFile: "/etc/ssl/server.pem", allowInvalidHostnames: true, mode: "requireSSL" }
}, security: { authorization: "enabled" }, storage: { dbPath: "/data/db1" } }
2017-01-13T12:58:55.211+0000 I - [initandlisten] Detected data files in /data/db1 created by the 'wiredTiger' storage engine, so setting the active storage engine to 'wiredTiger'.
2017-01-13T12:58:55.212+0000 W - [initandlisten] Detected unclean shutdown - /data/db1/mongod.lock is not empty.
2017-01-13T12:58:55.212+0000 W STORAGE [initandlisten] Recovering data from the last clean checkpoint.
2017-01-13T12:58:55.212+0000 I STORAGE [initandlisten] wiredtiger_open config: create,cache_size=1G,session_max=20000,eviction=(threads_max=4)
,config_base=false,statistics=(fast),log=(enabled=true,archive=true,path=journal,compressor=snappy),file_manager=(close_idle_time=100000),checkpoint=(wait=60,log_size=2GB),statistics_log=(wait=0),
2017-01-13T12:58:55.886+0000 I CONTROL [initandlisten] ** WARNING: You are running this process as the root user, which is not recommended.
2017-01-13T12:58:55.886+0000 I CONTROL [initandlisten]
2017-01-13T12:58:55.895+0000 I FTDC [initandlisten] Initializing full-time diagnostic data capture with directory '/data/db1/diagnostic.data'
2017-01-13T12:58:55.897+0000 I NETWORK [initandlisten] waiting for connections on port 27017 ssl
2017-01-13T12:58:55.897+0000 I NETWORK [HostnameCanonicalizationWorker] Starting hostname canonicalization worker
2017-01-13T12:58:56.026+0000 I FTDC [ftdc] Unclean full-time diagnostic data capture shutdown detected, found interim file, some metrics may have been lost. OK
$ mongo --port 27017 -u "my username" -p "my password"
--authenticationDatabase "" --ssl --sslPEMKeyFile /etc/ssl/client.pem
--sslCAFile /etc/ssl/ca.pem --host tim
MongoDB shell version: 3.2.11
connecting to: 127.0.0.1:27017/datatest
2017-01-13T12:35:58.247+0000 I NETWORK [initandlisten] connection accepted from 127.0.0.1:38902 #8 (1 connection now open)
2017-01-13T12:35:58.259+0000 E NETWORK [thread1] SSL peer certificate validation failed: self signed certificate
2017-01-13T12:35:58.259+0000 E QUERY [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: self signed certificate :
connect@src/mongo/shell/mongo.js:231:14
@(connect):1:6
2017-01-13T12:35:58.263+0000 E NETWORK [conn8] SSL peer certificate validation failed: self signed certificate
2017-01-13T12:35:58.263+0000 I NETWORK [conn8] end connection 127.0.0.1:38902 (0 connections now open)
$ mongo --port 27017 -u '<_username_>' -p '<_password_>'
--authenticationDatabase "<_my db_>" --ssl --sslPEMKeyFile
/etc/ssl/client.pem --sslCAFile /etc/ssl/ca.pem --host localhost
