我已经配置了 3 个节点的 MongoDB 副本集，下面是 MongoDB.conf 文件，副本集成员无法加入集群。

  systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log

storage:
  dbPath: /data/iddi
  journal:
    enabled: true

# how the process runs
processManagement:
  fork: true  # fork and run in background
  pidFilePath: /var/run/mongodb/mongod.pid  # location of pidfile
  timeZoneInfo: /usr/share/zoneinfo

net:
  port: 27017
  bindIp: 0.0.0.0
  ssl:
      mode: requireSSL
      PEMKeyFile: /etc/ssl/mongodb.pem
      CAFile: /etc/ssl/CA.pem
      clusterFile: /etc/ssl/mongodb.pem

security:
 keyFile: /opt/mongo-keyfile
# authorization: enabled
 clusterAuthMode: x509


replication:
  replSetName: mongod

下面是主从服务器的日志

    2018-07-03T12:08:56.107+0000 I REPL_HB  [replexec-3] Error in heartbeat (requestId: 8090) to node1.mongod:27018, response status: Unauthorized: command replSetHeartbeat requires authentication
2018-07-03T12:08:56.606+0000 I REPL_HB  [replexec-3] Error in heartbeat (requestId: 8091) to node2.mongod:27019, response status: Unauthorized: command replSetHeartbeat requires authentication
2018-07-03T12:08:56.607+0000 I REPL_HB  [replexec-3] Error in heartbeat (requestId: 8092) to node1.mongod:27018, response status: Unauthorized: command replSetHeartbeat requires authentication
2018-07-03T12:08:57.106+0000 I REPL_HB  [replexec-3] Error in heartbeat (requestId: 8093) to node2.mongod:27019, response status: Unauthorized: command replSetHeartbeat requires authentication
2018-07-03T12:08:57.107+0000 I REPL_HB  [replexec-3] Error in heartbeat (requestId: 8094) to node1.mongod:27018, response status: Unauthorized: command replSetHeartbeat requires authentication

辅助服务器日志

2018-07-03T10:48:45.695+0000 I ACCESS   [conn8] Failed to authenticate CN=mongod@$external from client 172.17.0.1:46320 with mechanism MONGODB-X509: UserNotFound: Could not find user CN=mongod@$external
2018-07-03T10:48:45.696+0000 I NETWORK  [conn8] end connection 172.17.0.1:46320 (0 connections now open)
2018-07-03T10:48:45.697+0000 I NETWORK  [listener] connection accepted from 172.17.0.1:46328 #9 (1 connection now open)
2018-07-03T10:48:45.702+0000 I NETWORK  [conn9] received client metadata from 172.17.0.1:46328 conn9: { driver: { name: "NetworkInterfaceTL", version: "4.0.0" }, os: { type: "Linux", name: "CentOS Linux release 7.4.1708 (Core) ", architecture: "x86_64", version: "Kernel 3.10.0-862.el7.x86_64" } }
2018-07-03T10:48:45.703+0000 I ACCESS   [conn9]  authenticate db: $external { authenticate: 1, mechanism: "MONGODB-X509", user: "CN=mongod", $db: "$external" }
2018-07-03T10:48:45.703+0000 I ACCESS   [conn9] Failed to authenticate CN=mongod@$external from client 172.17.0.1:46328 with mechanism MONGODB-X509: UserNotFound: Could not find user CN=mongod@$external
2018-07-03T10:53:35.211+0000 I CONTROL  [LogicalSessionCacheReap] Sessions collection is not set up; waiting until next sessions reap interval: Replication has not yet been configured

最佳答案

用于集群成员内部身份验证的成员证书(在本例中为 /etc/ssl/mongodb.pem)应该在 key subject 中具有更多属性。来自mongodb docs :

The Distinguished Name (DN), found in the member certificate’s subject, must specify a non-empty value for at least one of the following attributes: Organization (O), the Organizational Unit (OU) or the Domain Component (DC).

可以找到关于如何生成这些证书的很好的教程(带有一些适当的解释)here .

关于mongodb 副本集成员无法通过 SSL 加入集群，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/51154437/