mongodb - 如何修复 mongo 中的 SSL 错误 "CSSMERR_TP_VERIFY_ACTION_FAILED"？

Question

每当我尝试使用 SSL 标志 --ssl、--sslAllowInvalidHostnames 和 --sslCAFile 进行连接时，我都会看到此错误消息>:

MongoDB shell version v4.0.10
connecting to: mongodb://<redacted>
2019-07-01T14:47:17.420-0700 D NETWORK  [js] creating new connection to:<redacted>
2019-07-01T14:47:17.687-0700 E NETWORK  [js] SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected
2019-07-01T14:47:17.687-0700 D -        [js] User Assertion: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected src/mongo/transport/session_asio.h 242
2019-07-01T14:47:17.687-0700 D -        [js] User Assertion: InternalError: couldn't connect to server <redacted>, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected src/mongo/scripting/mozjs/mongo.cpp 757
2019-07-01T14:47:17.687-0700 E QUERY    [js] Error: couldn't connect to server <redacted>, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected :
connect@src/mongo/shell/mongo.js:344:17
@(connect):2:6
2019-07-01T14:47:17.687-0700 D -        [js] User Assertion: Location12513: connect failed src/mongo/shell/shell_utils.cpp 344
2019-07-01T14:47:17.687-0700 I QUERY    [js] MozJS GC prologue heap stats -  total: 3664180 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY    [js] MozJS GC epilogue heap stats -  total: 2620 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY    [js] MozJS GC prologue heap stats -  total: 4916 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY    [js] MozJS GC epilogue heap stats -  total: 12 limit: 0
2019-07-01T14:47:17.690-0700 D -        [main] User Assertion: Location12513: connect failed src/mongo/scripting/mozjs/proxyscope.cpp 302
exception: connect failed

我已验证以下内容:

• 我的 SSL 证书是最新的并确认是正确的
• 我的 SSL 版本是 1.0.2s
• 我的mongo版本更新到v4.0.10
• 我使用的是 MacOS X 10.14.5

这似乎是一个与 Apple 非常相关的问题，因为关于失败消息的唯一引用列在 https://developer.apple.com/documentation/security/1396762-cmsdecodercopysignerstatus?language=objc 中。

我还可以检查什么来解决 CSSMERR_TP_VERIFY_ACTION_FAILED 上的这个问题？

希望通过 SSL 证书连接到数据库。

Answer 1

能够通过将我的 mongo shell 版本降级到 3.6.8 来解决这个问题，对于那些遇到同样问题的人来说，是 mac 上的 v4 mongo shell 导致了这个问题。