背景 我正在尝试以与生产运行相同的方式在本地运行 mongo，并启用完整的 ssl 验证。 Mongo 提示证书是自签名的，但我指定了一个 ca.crt 文件，我认为应该将其视为根证书以进行验证。如果这是合理的，那么我认为我的 mongo 配置或证书生成不正确。

SSL key /证书/pem 要创建 ssl 内容，我正在运行以下命令

#!/bin/sh

# Generate self signed root CA cert
openssl req -nodes -x509 -newkey rsa:2048 -keyout ca.key -out ca.crt -subj "/emailAddress=dev@gmail.com"


# Generate server cert to be signed
openssl req -nodes -newkey rsa:2048 -keyout server.key -out server.csr -subj "/emailAddress=dev@gmail.com"

# Sign the server cert
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

# Create server PEM file
cat server.key server.crt > server.pem


# Generate client cert to be signed
openssl req -nodes -newkey rsa:2048 -keyout client.key -out client.csr -subj "/emailAddress=dev@gmail.com"

# Sign the client cert
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAserial ca.srl -out client.crt

# Create client PEM file
cat client.key client.crt > client.pem

Mongo 数据库配置 我正在运行的 mongo 配置(在 docker 内部)如下。 (其中/data/mongo 是上面生成的位置)。

net:
  port: 27017
  ssl:
    mode: requireSSL
    CAFile: /data/mongo/ca.crt
    PEMKeyFile: /data/mongo/server.pem
    allowInvalidHostnames: true
setParameter:
   enableLocalhostAuthBypass: true

通过

mongo --config config/location

连接到 mongo 然后，我尝试使用 mongo 命令行连接到服务器，如下所示。

mongo --ssl --sslPEMKeyFile /data/mongo/client.pem --sslCAFile /data/mongo/ca.crt

得到如下输出

MongoDB shell version: 3.2.14
connecting to: test
2017-07-19T20:12:31.456+0000 I NETWORK  [initandlisten] connection accepted from 127.0.0.1:60516 #1 (1 connection now open)
2017-07-19T20:12:31.461+0000 E NETWORK  [conn1] SSL peer certificate validation failed: self signed certificate
2017-07-19T20:12:31.461+0000 I NETWORK  [conn1] end connection 127.0.0.1:60516 (0 connections now open)
2017-07-19T20:12:31.461+0000 E NETWORK  [thread1] SSL peer certificate validation failed: self signed certificate
2017-07-19T20:12:31.461+0000 E QUERY    [thread1] Error: socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: self signed certificate :
connect@src/mongo/shell/mongo.js:229:14
@(connect):1:6

exception: connect failed

最佳答案

明白了!基本上它需要在主题行中提供更多数据，或者 CN 需要成为 CA 的 ROOTCA。任何可以评论原因的人都将不胜感激。

#!/bin/sh
prefix="/C=CN/ST=GD/L=city/O=company"

# Generate self signed root CA cert
openssl req -nodes -x509 -newkey rsa:2048 -keyout ca.key -out ca.crt -subj "${prefix}/CN=ROOTCA"


# Generate server cert to be signed
openssl req -nodes -newkey rsa:2048 -keyout server.key -out server.csr -subj "${prefix}/CN=127.0.0.1"

# Sign the server cert
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

# Create server PEM file
cat server.key server.crt > server.pem


# Generate client cert to be signed
openssl req -nodes -newkey rsa:2048 -keyout client.key -out client.csr -subj "${prefix}/CN=127.0.0.1"

# Sign the client cert
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAserial ca.srl -out client.crt

# Create client PEM file
cat client.key client.crt > client.pem

一些相关资源，如果有人遇到类似的麻烦

答案是从

https://www.mongodb.com/blog/post/secure-mongodb-with-x-509-authentication https://raw.githubusercontent.com/tjworks/mongoscripts/master/x509/setup-x509.sh

和我几乎一模一样的stack exchange ticket也可以在

https://dba.stackexchange.com/questions/151251/mongodb-error-self-signed-certificate-in-certificate-chain?newreg=20bca440682842c085a8764dd7c91e96

关于mongodb - 使用 mongo + ssl 运行开发环境，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/45207890/