node.js - 蒙哥错误: self signed certificate in certificate chain

Question

我正在尝试将我的 Node 服务器与启用了 ssl 选项的 mongodb 连接。

mongod.conf

storage:
  dbPath: /var/lib/mongodb
  journal:
  enabled: true

# where to write logging data.
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log

# network interfaces
net:
  port: XX
  bindIp: 127.0.0.1,XXX.XX.XX.XXX
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/PEMKEYFILE.pem
    PEMKeyPassword: "PASSWORDFORPEM"
    CAFile: /etc/ssl/CAFILE.pem

security:
  authorization: enabled

replication:
  oplogSizeMB: 1024
  replSetName: "REPLSET"

Node 服务器配置文件

MONGO_URL: '<pathToMongoDb>/<db>',
        MONGO_REPLICA_SET_READ_PREFERENCE: 'nearest',
        MONGO_REPLICA_SET: {
            ssl: true,
            sslValidate: true,
            sslKey: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCert: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCa: fs.readFileSync('/etc/ssl/CAFILE.pem'),
            replicaSet: 'REPLSET',
            auto_reconnect: false,
            poolSize: 24,
            socketOptions: {
                keepAlive: 1000,
                connectTimeoutMS: 30000
            }
        },
        MONGO_SERVER: {
            ssl: true,
            sslValidate: false,
            checkServerIdentity: false,
            sslKey: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCert: fs.readFileSync('/etc/ssl/mongodb.pem'),
            sslCA: fs.readFileSync('/etc/ssl/CAFILE.pem'),
            poolSize: 24,
            socketOptions: { keepAlive: 300000, connectTimeoutMS: 30000 },
            reconnectTries: Number.MAX_VALUE,
            reconnectInterval: 1000
        },
        MONGO_CHECK_SERVER_IDENTITY: false,

Mongoose 文件

mongoose.connect(config.MONGO_URL,{
  db: {
      native_parser: true,
      readPreference: config.MONGO_REPLICA_SET_READ_PREFERENCE
  },
  server: config.MONGO_SERVER,
  replset: config.MONGO_REPLICA_SET,
  user: config.MONGO_USER,
  pass: config.MONGO_PASSWORD,
  auth: {
      authdb: config.MONGO_AUTHDB
  }

})

我已经创建了 CA 证书和签名证书，但 Node 服务器返回给我错误:MongoError: failed to connect to server [XX.XXX.XXX.XX:port] on first connect MongoError: self signed certificate in certificate chain我可以使用以下命令使用 shell 连接到 mongo

mongo XX.XX.XX.XXX:XX/<db> -u <user> -p <pass> --authenticationDatabase=admin --ssl --sslPEMKeyFile=/etc/ssl/PEMKEYFILE.pem --sslCAFile /etc/ssl/CAFILE.pem --sslAllowInvalidHostnames

请告诉我哪里出错了。谢谢

Answer 1

当您拥有自签名 CA 时，会发生此特定错误。

使用 mongo 3.3.4 驱动程序，它为我连接

var userName = encodeURIComponent("emailAddress=myemail@example.com,CN=notsameasca,OU=notsameasca,O=my.fqdn.com,L=HomeCity,ST=HomeState,C=XX");
const MongoDBURI = `mongodb://${userName}@dev.vm:27017?authMechanism=MONGODB-X509&tls=true`;


MongoClient.connect(url,{
        tlsAllowInvalidHostnames: true,
        tlsAllowInvalidCertificates: true,
        tlsCertificateKeyFile: "./ssl/keyandcert.pem",
      })

从命令行连接到服务器时也会发生这种情况，除非您使用 --tlsAllowInvalidCertificates 开关。

mongo -port 27017 --tls --tlsCertificateKeyFile mongoadmin.pem --tlsAllowInvalidCertificates

您需要在客户端连接中指定 --tlsAllowInvalidCertificates。

这一切都很难做到正确，祝你好运......你会需要它。