Mongo Gandi SSL certificate not trusted

Question

I have a problem on MongoDB for using the SSL mode. When I trying to connect on my database, I have this error.

mongo --ssl --sslCAFile /etc/ssl/certs/GandiStandardSSLCA2.pem  --host plip.plop.com

MongoDB shell version: 3.0.6
connecting to: plip.plop.com:27017/test
2015-10-16T10:24:23.122+0000 E NETWORK  SSL peer certificate validation failed:certificate not trusted
2015-10-16T10:24:23.126+0000 E QUERY    Error: socket exception [CONNECT_ERROR] for
at connect (src/mongo/shell/mongo.js:181:14)
at (connect):1:6 at src/mongo/shell/mongo.js:181

my server respond:

2015-10-16T10:26:53.034+0000 I NETWORK  [initandlisten] connection accepted from 172.17.0.227:48786 #1 (1 connection now open)
2015-10-16T10:26:53.046+0000 W NETWORK  [conn1] no SSL certificate provided by peer
2015-10-16T10:26:53.046+0000 I NETWORK  [conn1] end connection 172.17.0.227:48786 (0 connections now open)

( In can connect to my db if I use the flag --sslAllowInvalidCertificates )

So now, how I do that:

I have added SSL cert with this code:

cp wildcart.plop.com.crt /etc/ssl/certs/wildcart.plop.com.crt
cp wildcart.plop.com.key /etc/ssl/private/wildcart.plop.com.key
cp GandiStandardSSLCA2.pem /usr/local/share/ca-certificates/gandi.net /GandiStandardSSLCA2.crt # come from https://wiki.gandi.net/en/ssl/intermediate
cat /etc/ssl/private/wildcart.plop.com.key /etc/ssl/certs/wildcart.plop.com.crt > /etc/ssl/certs/mongodb.pem
rm /etc/ssl/private/wildcart.plop.com.key /etc/ssl/certs/wildcart.plop.com.crt
update-ca-certificates
c_rehash

and my mongodb is start with this line mongod --replSet plop --config /etc/mongodb/mongod

/etc/mongodb/mongod content:

net:
    ssl:
        mode: requireSSL
        PEMKeyFile: /etc/ssl/certs/mongodb.pem
        CAFile: /etc/ssl/certs/GandiStandardSSLCA2.pem
        allowConnectionsWithoutCertificates: true

So can you help me on this problem ? I don't understand why my certificate isn't trusted. Do you have any idea on that ?

Thanks in advance for your help.

PS: Sorry for my english, I'm not totally fluent in english :D

http://dba.stackexchange.com/questions/80859/issues-with-self-signed-certificates-ssl-and-mongodb — Vaulstein, Oct 16 '15 at 10:45
It's not exactly the same case. I don't want to authenticate the client with a certificate. For the moment, I don't use any password or key for the client. I just want to connect on mongo through ssl. — David, Oct 16 '15 at 15:07

score 0 · Accepted Answer · answered Oct 22 '15 at 09:12

Mongodb doesn't use the system's global trust store.

The sslCAFile must contains all intermediary certificates of the verification chain.

In my case the certificate chain is like that:

Certificate chain
 0 s:/OU=Domain Control Validated/OU=Gandi Standard Wildcard SSL/CN=*.plop.com
   i:/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2
 1 s:/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2
   i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
 2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

So you need to concat Gandi intermediary certificates with AddTrust External CA Root intermediary certificates.

cat /etc/ssl/certs/GandiStandardSSLCA2.pem /ets/ssl/certs/AddTrust_External_Root.pem > /ets/ssl/certs/GandiStandardSSLCA2_full.pem

mongo --ssl --sslCAFile /ets/ssl/certs/GandiStandardSSLCA2_full.pem --host plip.plop.com

Enjoy

Why doesn't it use the global trust store? – Petah Sep 28 '16 at 22:36 — Petah, Sep 28 '16 at 22:36

Mongo Gandi SSL certificate not trusted

1 Answers1