mongodb - mongodump 错误 : x509: cannot validate certificate for because it doesn't contain any IP SANs

Question

我正在尝试设置 mongodump 以及 TLS/SSL 加密。为此，我一直在关注各种文章:Self-signed SSL connection using PyMongo , https://mydbops.wordpress.com/2020/05/02/securing-mongodb-cluster-with-tls-ssl/还有更多。
所以，我已经生成了 CA 证书。

#Create CA Private Certificate
openssl genrsa -passout pass:<password> -out ca.key -aes256 8192
 
#Sign CA Public Certificate
openssl req -x509 -new -extensions v3_ca -passin pass:<password> -key ca.key -days 365 -out ca-pub.crt -subj "/C=XX/L=Default City/O=Default Company Ltd"

然后，为 MongoDB 服务器创建一个 key 并使用 CA 对其进行自签名。

openssl req -nodes -newkey rsa:4096 -sha256 -keyout mongod.key -out mongod.csr -subj "/C=XX/L=Default City/O=Default Company Ltd/CN=<host-name-IP>";
openssl x509 -req -in mongod.csr -CA ca-pub.crt -passin pass:<password> -CAkey ca.key -CAcreateserial -out mongod.crt;
cat mongod.key mongod.crt > mongod.pem;

接下来，我为客户端创建了一个 conf 文件，内容如下:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
default_keyfile = mongo-client.key
prompt = no

[req_distinguished_name]
C = filled-appropriately
ST = filled-appropriately
L = filled-appropriately
O = client
OU = client-team
CN = .

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = IP:<mongodb-server-ip>

接下来，使用这个 .conf 文件，生成了一个 mongo 客户端 csr 文件

openssl req -new -nodes -out mongo-client.csr -config mongo-client.conf

然后，使用 CA 证书对这些进行自签名。

openssl x509 -req -in mongo-client.csr -CA ca-pub.crt -CAkey ca.key -out mongo-client.crt
cat mongo-client.key mongo-client.crt > mongo-client.pem

我已将 CA 和 MongoDB 服务器特定文件放置在适当的位置(在/etc/ssl 中)并更新了 mongod.conf 文件中的路径

  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/ca-pub.crt

更新后，执行 daemon-reload 并重新启动 mongod.service，并将 ca-pub.crt 和 mongo-client.pem 移动到适当的客户端服务器。
现在，当我尝试使用 mongo 命令连接到服务器时，它会成功连接。

mongo --tls --tlsCAFile ca-pub.crt --tlsCertificateKeyFile mongo-client.pem --host=<server-IP> -u <username> -p <password>

但是，当我尝试运行 mongodump 命令时:

mongodump --host=<server-IP> -u <username> -p <password> --ssl --sslCAFile=ca-pub.crt --sslPEMKeyFile=mongo-client.pem

它给出了这个错误:

Failed: can't create session: could not connect to server: server selection error: server selection timeout, current topology: { Type: Single, Servers: [{ Addr: <server-IP>, Type: Unknown, State: Connected, Average RTT: 0, Last error: connection() : x509: cannot validate certificate for <server-IP> because it doesn't contain any IP SANs }, ] }

注意:以上所有代码中，server-IP 的值都已适当添加。
任何人都可以为此提供解决方案或任何有用的资源。任何帮助，将不胜感激。谢谢。

Answer 1

SubjectAltName 与我过去使用的不同。
创建一个通用的签名请求

echo '[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name

[ req_distinguished_name ]' | sudo tee common.csr.conf

openssl req -nodes -sha256 -newkey rsa:4096 -keyout node1.key.pem -out node1.csr -subj "/C=US/ST=Oregon/L=Springfield/O=Some Organization/OU=Replicaset/CN=node1" -config common.csr.conf

创建扩展文件

echo '
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth, emailProtection
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = node1.barry.test
IP.1 = 127.0.0.1' | sudo tee node1.ext

签署证书

openssl x509 -req -sha256 -in node1.csr -CA ca.crt.pem -CAkey ca.key.pem -CAcreateserial -days 365 -out node1.crt.pem -extfile node1.ext

将证书和 key 合并到 PEM 文件中

cat node1.key.pem node1.crt.pem > node1.pem