java - Spring Boot 使用 ssl 连接到 mongodb(对等证书验证失败)

Question

我无法将我的 spring-boot-app(v1.5.7)连接到我的 mongodb-server(带有 ssl 的 localhost(Win7_x64)；v.3.4.6；自签名；没有 ssl 的登录正在工作)。

RoboT3 可以毫无问题地连接到我的 mongodb。

我遵循了几种解决方案，这是我尝试过的最后一个没有成功的解决方案:

将此添加到我的主类中:

    @Bean
    public MongoClientOptions mongoClientOptions() {
        System.setProperty("javax.net.ssl.trustStore","ssl/keystore/mongoStore.ts");
        System.setProperty("javax.net.ssl.trustStorePassword","123456");
        System.setProperty ("javax.net.ssl.keyStore","ssl/keystore/mongoClientKeyCert.jks");
        System.setProperty ("javax.net.ssl.keyStorePassword","123456");
        MongoClientOptions.Builder builder = MongoClientOptions.builder();
        MongoClientOptions options = builder.sslEnabled(true).sslInvalidHostNameAllowed(true).build();        
        return options;
    }

我在 this 文章之后创建了 trustStore 和 keyStore。

ca、客户端和服务器的 crt、pem 和 key 是根据 this 问题创建的。

抛出异常:

com.mongodb.MongoSocketReadException: Exception receiving message
    at com.mongodb.connection.InternalStreamConnection.translateReadException(InternalStreamConnection.java:483)
    at com.mongodb.connection.InternalStreamConnection.receiveMessage(InternalStreamConnection.java:228)
    at com.mongodb.connection.CommandHelper.receiveReply(CommandHelper.java:134)
    at com.mongodb.connection.CommandHelper.receiveCommandResult(CommandHelper.java:121)
    at com.mongodb.connection.CommandHelper.executeCommand(CommandHelper.java:32)
    at com.mongodb.connection.InternalStreamConnectionInitializer.initializeConnectionDescription(InternalStreamConnectionInitializer.java:85)
    at com.mongodb.connection.InternalStreamConnectionInitializer.initialize(InternalStreamConnectionInitializer.java:45)
    at com.mongodb.connection.InternalStreamConnection.open(InternalStreamConnection.java:116)
    at com.mongodb.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:113)
    at java.lang.Thread.run(Unknown Source)
Caused by: java.net.SocketException: Software caused connection abort: recv failed
    at java.net.SocketInputStream.socketRead0(Native Method)
    at java.net.SocketInputStream.read(Unknown Source)
    at java.net.SocketInputStream.read(Unknown Source)
    at sun.security.ssl.InputRecord.readFully(Unknown Source)
    at sun.security.ssl.InputRecord.read(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown Source)
    at sun.security.ssl.AppInputStream.read(Unknown Source)
    at com.mongodb.connection.SocketStream.read(SocketStream.java:85)
    at com.mongodb.connection.InternalStreamConnection.receiveResponseBuffers(InternalStreamConnection.java:494)
    at com.mongodb.connection.InternalStreamConnection.receiveMessage(InternalStreamConnection.java:224)
    ... 8 common frames omitted

MongoDB(控制台)的错误消息:

SSL peer certificate validation failed: self signed certificate

MongoDB 启动命令:

.\mongod.exe --dbpath .\db --auth -sslMode requireSSL --sslAllowConnectionsWithoutCertificates --sslPEMKeyFile .\ssl\server\server.pem --sslCAFile .\ssl\ca\ca.pem

我该怎么做才能让它发挥作用？

Answer 1

我们遇到了类似的问题，这就是我们所做的:

向 keytool 注册信任 CA 证书: ./path_to_your_crt.crt

使用 openssl 将客户端证书 .pem ( ./path_to_your_pem.pem ) 文件转换为 pkcs12 ( ./output_key_path.pkcs12 )

向 keytool 注册客户端证书:( ./output_key_path.pkcs12 )

keytool -import -alias clusterkey -file ./path_to_your_crt.crt -keystore mongostore -storetype pkcs12 -storepass your_password  -noprompt
openssl pkcs12 -passout pass:your_password -export -out ./output_key_path.pkcs12 -in ./path_to_your_pem.pem
keytool -importkeystore -srckeystore ./output_key_path.pkcs12 -srcstoretype PKCS12 -destkeystore mongoclient -deststoretype pkcs12 -srcstorepass your_password -deststorepass your_password -noprompt

在内部，我像您一样配置了 bean