Nginx - Compass and MongoDB VPS instance won't establish TLS connection

jurijus01
December 6, 2024
186 views
3 votes
3 Answers

Compass won’t establish connection to VPS MongoDB instance. Here is the log:

{"t":{"$date":"2024-12-05T20:38:26.097+00:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"185.121.228.66:51324","uuid":{"uuid":{"$uuid":"5f86b525-d80e-45ea-b05d-ca1e33028b58"}},"connectionId":52,"connectionCount":1}}
{"t":{"$date":"2024-12-05T20:38:26.111+00:00"},"s":"I",  "c":"NETWORK",  "id":6723804, "ctx":"conn52","msg":"Ingress TLS handshake complete","attr":{"durationMillis":13}}
{"t":{"$date":"2024-12-05T20:38:26.112+00:00"},"s":"E",  "c":"NETWORK",  "id":23256,   "ctx":"conn52","msg":"SSL peer certificate validation failed","attr":{"error":"SSL peer certificate validation failed: unable to get issuer certificate"}}
{"t":{"$date":"2024-12-05T20:38:26.112+00:00"},"s":"I",  "c":"EXECUTOR", "id":22988,   "ctx":"conn52","msg":"Error receiving request from client. Ending connection from remote","attr":{"error":{"code":141,"codeName":"SSLHandshakeFailed","errmsg":"SSL peer certificate validation failed: unable to get issuer certificate"},"remote":"185.121.228.66:51324","connectionId":52}}
{"t":{"$date":"2024-12-05T20:38:26.112+00:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn52","msg":"Connection ended","attr":{"remote":"185.121.228.66:51324","uuid":{"uuid":{"$uuid":"5f86b525-d80e-45ea-b05d-ca1e33028b58"}},"connectionId":52,"connectionCount":0}}

No idea what is causing the problem. The files have the same contents on both ends and readable.

mongo.conf:

net:
  port: 27017
#  bindIp: 127.0.0.1
  bindIpAll: true
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/certAndKey.pem
    CAFile: /etc/ssl/chain.pem

Before I tried NGINX on VPS end and Compass was establishing connection fine. Make me think the issue is on MongoDB end.

certAndKey contents:

Chain.pem:

There is also fullchain.pem file, but not using it. All certs obtained from LetsEncrypt via Certbot.

Any ideas why MongoDB on VPS not liking what Compass is trying to communicate?

Tags: mongodb mongodb-replica-set

Answers

Chosen as BEST ANSWER
- jurijus01
- December 6, 2024 at 9:34 am
- 0 votes
0
To summarize the solution provided by Wernfried Domscheit and put everything in plain English, as this certificate subject us super-ultra-confusing. As Certbot by LetsEncrypt generates you the following files:
```
1) cert.pem (as known as "Your server certificate")
2) chain.pem (as known as "Intermediate certificate")
3) fullchain.pem (2 of the above in a single file. The 1st half is erver cert, the other half is intermediate cert. Anyhow this file is useless in our case and adds more confusion, so ignore this file)
4) privkey.pem
```
Here is what you need to do:
1. make a file containing both your server cert and privkey;
2. make another file containing both the intermediate cert and RootCA.
RootCA isn't provided by Certbot! You need download it from LetEncrypt website directly.

https://letsencrypt.org/certificates/][1]

It is ISRG Root X1, the self-signed one. Here is the direct link

[https://letsencrypt.org/certs/isrgrootx1.pem][1]

As for your mongod.cong, the tls part should like something like this:
```
tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/certKey.pem
    CAFile: /etc/ssl/intermRoot.pem
```
As for Compass connection, accordingly:
1. "Certificate Authority (.pem)" file shall be your intermRoot file
2. "Client Certificate and Key (.pem)" file shall be your certKey file

(Edit)

- Joe
- December 6, 2024 at 1:50 am
- 0 votes
0
Currently certAndKey.pem contains
```
Subject: CN = giftbutton.com
Issuer: C = US, O = Let's Encrypt, CN = E6
```
and chain.pem contains
```
Subject: C = US, O = Let's Encrypt, CN = E6
Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X1
```
The .pem file passed as CAFile should contain just the root certificate, i.e. ISRG Root X1. You will need to obtain that root cert and pass it in CAFile.

Put the intermediate certificate, server certificate, and server private key in the same file and pass it as certificateKeyFile.
Login or Signup to reply.

Add the root certificate to your CA. The chain.pem file should be this:

Usually Let’s Encrypt certificates are stored in your local certificate store, thus you can use also tlsUseSystemCA. I think in Compass and mongosh it is even the default.

Please signup or login to give your own answer.

Click here to cancel reply.

Nginx – Compass and MongoDB VPS instance won't establish TLS connection

Answers