pymongo [SSL: CERTIFICATE_VERIFY_FAILED]: certificate has expired on Mongo Atlas

Question

I am using MongoDB(Mongo Atlas) in my Django app. All was working fine till yesterday. But today, when I ran the server, it is showing me the following error on console

Exception in thread django-main-thread:
Traceback (most recent call last):
  File "c:\users\admin\appdata\local\programs\python\python39\lib\threading.py", line 973, in _bootstrap_inner
    self.run()
  File "c:\users\admin\appdata\local\programs\python\python39\lib\threading.py", line 910, in run
    self._target(*self._args, **self._kwargs)
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\utils\autoreload.py", line 64, in wrapper
    fn(*args, **kwargs)
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\core\management\commands\runserver.py", line 121, in inner_run
    self.check_migrations()
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\core\management\base.py", line 486, in check_migrations
    executor = MigrationExecutor(connections[DEFAULT_DB_ALIAS])
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\db\migrations\executor.py", line 18, in __init__
    self.loader = MigrationLoader(self.connection)
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\db\migrations\loader.py", line 53, in __init__
    self.build_graph()
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\db\migrations\loader.py", line 220, in build_graph
    self.applied_migrations = recorder.applied_migrations()
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\db\migrations\recorder.py", line 77, in applied_migrations
    if self.has_table():
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\db\migrations\recorder.py", line 56, in has_table
    tables = self.connection.introspection.table_names(cursor)
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\db\backends\base\introspection.py", line 52, in table_names
    return get_names(cursor)
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\django\db\backends\base\introspection.py", line 47, in get_names
    return sorted(ti.name for ti in self.get_table_list(cursor)
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\djongo\introspection.py", line 47, in get_table_list
    for c in cursor.db_conn.list_collection_names()
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\pymongo\database.py", line 880, in list_collection_names
    for result in self.list_collections(session=session, **kwargs)]
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\pymongo\database.py", line 842, in list_collections
    return self.__client._retryable_read(
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\pymongo\mongo_client.py", line 1514, in _retryable_read
    server = self._select_server(
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\pymongo\mongo_client.py", line 1346, in _select_server
    server = topology.select_server(server_selector)
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\pymongo\topology.py", line 244, in select_server
    return random.choice(self.select_servers(selector,
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\pymongo\topology.py", line 202, in select_servers
    server_descriptions = self._select_servers_loop(
  File "C:\Users\Admin\AppData\Local\Programs\Python\Python39\Lib\site-packages\pymongo\topology.py", line 218, in _select_servers_loop
    raise ServerSelectionTimeoutError(
pymongo.errors.ServerSelectionTimeoutError: cluster0-shard-00-02.mny7y.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129),cluster0-shard-00-01.mny7y.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129),cluster0-shard-00-00.mny7y.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129), Timeout: 30s, Topology Description: <TopologyDescription id: 6155f0c9148b07ff5851a1b3, topology_type: ReplicaSetNoPrimary, servers: [<ServerDescription ('cluster0-shard-00-00.mny7y.mongodb.net', 27017) server_type: Unknown, rtt: None, error=AutoReconnect('cluster0-shard-00-00.mny7y.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')>, <ServerDescription ('cluster0-shard-00-01.mny7y.mongodb.net', 27017) server_type: Unknown, rtt: None, error=AutoReconnect('cluster0-shard-00-01.mny7y.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')>, <ServerDescription ('cluster0-shard-00-02.mny7y.mongodb.net', 27017) server_type: Unknown, rtt: None, error=AutoReconnect('cluster0-shard-00-02.mny7y.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')>]>

I am using djongo as the database engine

DATABASES = {
    'default': {
            'ENGINE': 'djongo',
            'NAME': 'DbName',
            'ENFORCE_SCHEMA': False,
            'CLIENT': {
                'host': 'mongodb+srv://username:password@cluster0.mny7y.mongodb.net/DbName?retryWrites=true&w=majority'
            }  
    }
}

And following dependencies are being used in the app

dj-database-url==0.5.0
Django==3.2.5
djangorestframework==3.12.4
django-cors-headers==3.7.0
gunicorn==20.1.0
psycopg2==2.9.1
pytz==2021.1
whitenoise==5.3.0
djongo==1.3.6
dnspython==2.1.0

What should be done in order to resolve this error?

Todor Minakov · Accepted Answer · 2021-10-03T05:57:25.343

16

This is because of a root CA Let’s Encrypt uses (and Mongo Atals uses Let's Encrypt) has expired on 2020-09-30 - namely the "IdentTrust DST Root CA X3" one.

The fix is to manually install in the Windows certificate store the "ISRG Root X1" and "ISRG Root X2" root certificates, and the "Let’s Encrypt R3" intermediate one - link to their official site - https://letsencrypt.org/certificates/

Copy from the comments: download the .der field from the 1st category, download, double click and follow the wizard to install it.

edited Oct 03 '21 at 05:57

answered Oct 01 '21 at 14:29

Todor Minakov

19,097
3
55
60

1

Thanks for the reply @Todor. The certificates are divided into 2 categories and each category has a further 3 subcategories. Can you please point out which file to download and also where to put it on the computer? – Malina Dale Oct 01 '21 at 16:50
2

Go with the .der field from the 1st category, download, double click and follow the wizard to install it. – Todor Minakov Oct 01 '21 at 17:08
1

The issue is solved now. Thanks a lot! – Malina Dale Oct 01 '21 at 17:27
I know - I experienced it first hand :) – Todor Minakov Oct 01 '21 at 18:41
just installed above-mentioned certificates and everything just worked. Thanks @TodorMinakov – abdadeel Dec 01 '22 at 22:08

score 13 · Answer 2 · answered Oct 10 '21 at 02:42

I solved the problem on my windows machine. It had to do with the expiring DST Root CA X3 certificate from Let’s Encrypt.

Download https://letsencrypt.org/certs/lets-encrypt-r3.pem
rename file .pem to .cer
double click and install
Restart your PC

Still, if it doesn't work

Go to https://letsencrypt.org/certificates/
Download ISRG Root X1, ISRG Root X2 ( Root Certificates), Let’s Encrypt R3 ( Intermediate Certificates)
Restart your PC

score 5 · Answer 3 · edited Apr 08 '22 at 16:40

5

I found the solution in the mongoDB community. Download https://letsencrypt.org/certs/lets-encrypt-r3.pem

rename the .pem file to .cer
double-click and install
try to run the app

Your SSL issue should be resolved.

source: https://www.mongodb.com/community/forums/t/keep-getting-serverselectiontimeouterror/126190/13

edited Apr 08 '22 at 16:40

Worthwelle

1,244
1
16
19

answered Oct 16 '21 at 04:18

SATHISH KUMAR

51
2

score 0 · Answer 4 · answered Jan 29 '22 at 22:03

Another solution from MongoDB community. Super easy and worked for me. You can read the full solution here -

https://www.mongodb.com/community/forums/t/keep-getting-serverselectiontimeouterror/126190/

Here is what worked for me (Windows 11) -

heck that dnspython, pymongo and certifi are installed in your virtual environment or install them by:

pip install dnspython pymongo certifi

Can you use the terminal/command line and run Python, in the Python environment can you enter and = run the following commands (please change the password as appropriate for your user in your Atlas cluster):

from pymongo import MongoClient
import certifi
s = MongoClient("mongodb+srv://m220student:m220password@cluster0.maiqr.mongodb.net", tlsCAFile=certifi.where())

As it’s currently written, your answer is unclear. Please [edit] to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers [in the help center](/help/how-to-answer). — Community, Jan 30 '22 at 03:51
The following line solved my problem: ~> mongoengine.connect(host=DB_URI, alias='default', tlsCAFile=certifi.where()) — Braian, Dec 23 '22 at 21:25

pymongo [SSL: CERTIFICATE_VERIFY_FAILED]: certificate has expired on Mongo Atlas

4 Answers4

Linked