Htykuut

I set up a mongoDB database with SSL security on an Ubuntu 16.04.5 LTS server and I have been using it for a few months. To set up SSL on mongo I followed the tutorial by Rajan Maharjan on medium.com (link). Coming back to my server after a short period of not using it, I received the following error message:

SSL peer certificate validation failed: certificate has expired

Looking at the mongo log, I found:

[PeriodicTaskRunner] Server certificate is now invalid. It expired on 2018-11-10T08:10:11.000Z

So I regenerated and re-signed all my certificates with the rootCA.key file, following the same steps as when creating certificates for the first time. I restarted mongod with:

service mongod restart

And now I have the "self signed certificate" error:

MongoDB shell version v4.0.2

connecting to: mongodb://IP:port/

2018-11-21T13:11:10.584+0000 E NETWORK  [js] SSL peer certificate     

validation failed: self signed certificate

2018-11-21T13:11:10.584+0000 E QUERY    [js] Error: 

couldn't connect to server IP:port, connection attempt failed: 

SSLHandshakeFailed: SSL peer certificate validation failed: self signed certificate :

connect@src/mongo/shell/mongo.js:257:13

@(connect):1:6

exception: connect failed

My connection string is the following:

mongo --ssl --sslCAFile /PATH/TO/rootCA.pem --sslPEMKeyFile /PATH/TO/mongodb.pem --host IP:port

I have not found any resources on re-signing certificates for mongoDB. Any help would be much appreciated.

EDIT

/etc/mongod.conf :

# mongod.conf



# for documentation of all options, see:

#   http://docs.mongodb.org/manual/reference/configuration-options/



# Where and how to store data.

storage:

  dbPath: /var/lib/mongodb

  journal:

    enabled: true

#  engine:

#  mmapv1:

#  wiredTiger:



# where to write logging data.

systemLog:

  destination: file

  logAppend: true

  path: /var/log/mongodb/mongod.log



# network interfaces

net:

  port: PORT

  bindIp: IP

  ssl:

    mode: requireSSL

    PEMKeyFile: /etc/ssl/mongodb.pem

    CAFile: /etc/ssl/rootCA.pem



# how the process runs

 processManagement:

  timeZoneInfo: /usr/share/zoneinfo



#security:

security:

   authorization: "enabled"



#operationProfiling:



#replication:



#sharding:



## Enterprise-Only Options:



#auditLog:



#snmp:

I managed to get it to work again by following these steps (which, for some reason, did not work before):

• remove mongodb.* files from /etc/ssl/
  


• regenerate certificates with the commands:
  
  
  
  
  • openssl genrsa -out mongodb.key 2048
  
  
  • openssl req -new -key mongodb.key -out mongodb.csr
  
  
  • Server address in the field Common Name (eg, YOUR name)
    
  
  
  • openssl x509 -req -in mongodb.csr -CA rootCA.pem -CAkey /PATH/TO/rootCA.key -CAcreateserial -out mongodb.crt -days 500 -sha256
  
  
  • cat mongodb.key mongodb.crt > mongodb.pem
  
  
  
  


• chmod 666 mongodb.pem


• service mongod restart


• cat /var/log/mongodb/mongod.log (to check status)

And to launch the mongo shell

• mongo --ssl --sslCAFile /PATH/TO/rootCA.pem --sslPEMKeyFile /PATH/TO/mongodb.pem --host IP:PORT

Thank you @AniketMaithani for trying to help me solve this issue.