Parse + mongodb + SSL: "SSL certificate provided by peer"

Question

During the migration of Parse servers before it shuts down, I try to create a simple instance of MongoDB in Digital Ocean. (I use this instead of mLab because my needs are very limited - a few MB of memory, a few hundred requests per week - and for this, the costs for mLab are quite high.)

Mongod works for me and I made some progress in SSL thanks to this tutorial using Let Encrypt, but now I'm stuck, the Parameter Migration Tool says “There are no servers available” and if I try to connect to the command line as follows:

mongo --ssl -u editAdmin -p "<password-here>" --host mydb.myhost.com dbname 

I get this error:

 MongoDB shell version: 3.2.7 connecting to: mydb.myhost.com:27017/dbname 2016-07-24T10:31:38.814-0700 E QUERY [thread1] Error: network error while attempting to run command 'isMaster' on host 'mydb.myhost.com:27017' : connect@src /mongo/shell/mongo.js:231:14 @(connect):1:6 exception: connect failed 

Server Log Report:

 2016-07-24T13:32:44.357-0400 I NETWORK [initandlisten] connection accepted from 12.345.67.89:33351 #39 (1 connection now open) 2016-07-24T13:32:44.390-0400 E NETWORK [conn39] no SSL certificate provided by peer; connection rejected 2016-07-24T13:32:44.390-0400 I NETWORK [conn39] end connection 12.345.67.89:33351 (0 connections now open) 

So, this assumes that the client must provide the certificate, but (a) I do not know how to provide it, and (b) Parse does not provide this as an option, so it should somehow not.

Thanks in advance for your help.

Answer 1

Key error message:

 no SSL certificate provided by peer; connection rejected 

When you enable TLS / SSL on MongoDB, MongoDB clients can now authenticate that the MongoDB server, who claims that the comparison path / SSL certificate of MongoDB TLS (specified in the PEMKeyFile property in the mongod.conf file), is against the public certification authority certificate that you provide MongoDB client to indicate which certification authority you trust.

But what I just described is sometimes called one-way TLS, while by default MongoDB provides two-way or mutual TLS authentication. The idea is that, perhaps, MongoDB does not want to accept clients from anyone (as a public website can do), but also wants to authenticate clients.

In TLS Mutual Auth, the same Certificate Authority that I mentioned above will issue client certificates, and the MongoDB server will check the client certificate to make sure that it was indeed issued by the corresponding Certificate Authority and that it is valid (for example, it has not expired) .

So this error says, "Hey, I expect my clients to submit a TLS certificate, but you have no idea."

How to fix this is described in Configuring mongod and mongos for TLS / SSL :

If you want to bypass validation for clients that do not provide certificates, allowConnectionsWithoutCertificates parameter allowConnectionsWithoutCertificates with mongod and mongos. If the client does not provide a certificate, verification does not occur. These connections, although not verified, are still encrypted using SSL.

Of course, you can also specify this in the mongod.conf file: https://docs.mongodb.com/manual/reference/configuration-options/#net.ssl.allowConnectionsWithoutCertificates

My preferred solution looks like this:

 net: port: 27017 bindIp: 172.0.0.1 # Set this to whatever your private IP address is ssl: mode: "requireSSL" PEMKeyFile: "/path/to/tls/private/key" CAFile: "/path/to/ca/public/cert" disabledProtocols: "TLS1_0,TLS1_1" allowConnectionsWithoutCertificates: true # <-- The line to add to your config 

Answer 2

You are using the SSL command (and I assume Parse is doing the same), so you are trying to connect using SSL. The client must provide a certificate when using SSL. https://docs.mongodb.com/manual/tutorial/configure-ssl-clients/ this link explains how to do this, and your problem is specifically mentioned

Answer 3

Just follow this tutorial , everything is there, I know that, of course, I followed this, and now I run parsing - a server without any previous knowledge ... I would recommend you use a MongoDB connection without an SSL certificate and allow it only localhost requests - so only this parser running on the same computer will gain access to this database ...