`mongosh` 无法连接到 MongoDB TLS 集群，但 `mongo` 可以——MongoServerSelectionError: Hostname/IP does not match certificate\'s altnames

Question

Metadata

版本：

Ubuntu焦点

MongoDB 5.0.14

mongod 从 args 开始：

/usr/bin/mongod --bind_ip_all --replSet=mongodb --auth --tlsCAFile=/etc/mongodb/external-ca.crt --tlsCertificateKeyFile=/etc/mongodb/external-cert.pem --tlsMode=preferTLS --clusterAuthMode=x509 --tlsAllowInvalidCertificates --tlsClusterCAFile=/etc/mongodb/internal-ca.crt --tlsClusterFile=/etc/mongodb/internal-cert.pem

问题

问题：无法通过mongosh 启用 TLS 连接到副本集

我在具有两个主机的副本集上启用了 TLS。当我尝试时：

sudo mongosh 'mongodb://<username>:<password>@<my ip>/admin?replicaSet=mongodb'  --tls --tlsCAFile /etc/mongodb/external-ca.crt --tlsCertificateKeyFile /etc/mongodb/external-cert.pem

我得到：

MongoServerSelectionError: Hostname/IP does not match certificate's altnames: IP: <my ip> is not in the cert's list:

我的日志显示这个IP在"certificateNames"：

{"t":{"$date":"2022-12-07T09:05:19.935Z"},"s":"E",  "c":"NETWORK",  "id":23257,   "ctx":"ReplicaSetMonitor-TaskExecutor","msg":"The server certificate does not match the remote host name","attr":{"remoteHost":"juju-29df15-1","certificateNames":"SAN(s): mongodb-0, juju-29df15-1.lxd, mongodb-0.mongodb-endpoints, <my-ip>, CN:  <my-ip>"}}

我还尝试了什么

如果我使用 mongo 而不是 mongosh：

sudo mongo 'mongodb://admin:5zymveLpT3rOlD6WACEuNM0wTJaNJTax@juju-29df15-1.lxd/admin?replicaSet=mongodb'  --tls --tlsCAFile /etc/mongodb/external-ca.crt --tlsCertificateKeyFile /etc/mongodb/external-cert.pem

这似乎在记录了一些消息后连接，特别是：

connecting to: mongodb://10.23.62.38:27017/admin?compressors=disabled&gssapiServiceName=mongodb&replicaSet=mongodb
{"t":{"$date":"2022-12-07T09:21:01.646Z"},"s":"W",  "c":"NETWORK",  "id":23237,   "ctx":"ReplicaSetMonitor-TaskExecutor","msg":"You have an IP Address in the DNS Name field on your certificate. This formulation is deprecated."}
{"t":{"$date":"2022-12-07T09:21:01.652Z"},"s":"W",  "c":"NETWORK",  "id":23237,   "ctx":"ReplicaSetMonitor-TaskExecutor","msg":"You have an IP Address in the DNS Name field on your certificate. This formulation is deprecated."}
{"t":{"$date":"2022-12-07T09:21:01.654Z"},"s":"W",  "c":"NETWORK",  "id":23237,   "ctx":"ReplicaSetMonitor-TaskExecutor","msg":"You have an IP Address in the DNS Name field on your certificate. This formulation is deprecated."}
{"t":{"$date":"2022-12-07T09:21:01.662Z"},"s":"W",  "c":"NETWORK",  "id":23237,   "ctx":"js","msg":"You have an IP Address in the DNS Name field on your certificate. This formulation is deprecated."}
{"t":{"$date":"2022-12-07T09:21:01.664Z"},"s":"W",  "c":"NETWORK",  "id":23237,   "ctx":"ReplicaSetMonitor-TaskExecutor","msg":"You have an IP Address in the DNS Name field on your certificate. This formulation is deprecated."}
Implicit session: session { "id" : UUID("97e7e144-1bd7-4a94-b33d-958da2507bec") }
MongoDB server version: 5.0.14
================
Warning: the "mongo" shell has been superseded by "mongosh",
which delivers improved usability and compatibility.The "mongo" shell has been deprecated and will be removed in
an upcoming release.
For installation instructions, see
https://docs.mongodb.com/mongodb-shell/install/
================
---
The server generated these startup warnings when booting:
        2022-12-06T16:56:40.822+00:00: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine. See http://dochub.mongodb.org/core/prodnotes-filesystem
        2022-12-06T16:56:42.686+00:00: While invalid X509 certificates may be used to connect to this server, they will not be considered permissible for authentication
---
---
        Enable MongoDB's free cloud-based monitoring service, which will then receive and display
        metrics about your deployment (disk utilization, CPU, operation statistics, etc).

        The monitoring data will be available on a MongoDB website with a unique URL accessible to you
        and anyone you share the URL with. MongoDB may use this information to make product
        improvements and to suggest MongoDB products and deployment options to you.

        To enable free monitoring, run the following command: db.enableFreeMonitoring()
        To permanently disable this reminder, run the following command: db.disableFreeMonitoring()
---
mongodb:PRIMARY>

然后我可以在这个 shell 中执行命令（耶）。

问题

所以我有两个问题：

1. 为什么我可以连接mongo但不能连接mongosh
2. 如果我可以在"certificateNames" 中看到<my-ip>，为什么我会收到错误MongoServerSelectionError: Hostname/IP does not match certificate's altnames: IP: <my ip> is not in the cert's list:？

Answer 1

我没有1. why can I connect with mongo but not with mongosh的答案

但对于 2.，会发生此错误，因为在创建证书签名请求时，IP 地址是通过 DNS 主题备用名称提供的。为了解决这个问题，我使用 IP 地址作为替代名称发出了证书签名请求。

Answer 2

这不是您问题的直接答案，但是，您的设置中存在配置错误。

问题

你的mongod配置了

--tlsCAFile=/etc/mongodb/external-ca.crt
--tlsCertificateKeyFile=/etc/mongodb/external-cert.pem
--tlsClusterCAFile=/etc/mongodb/internal-ca.crt
--tlsClusterFile=/etc/mongodb/internal-cert.pem

所以，这些openssl检查应该没问题：

cd /etc/mongodb
openssl verify -CAfile ./external-ca.crt ./external-cert.pem
openssl verify -CAfile ./internal-ca.crt ./internal-cert.pem

但是，与mongosh（或任何其他客户端）的连接应该会失败：

cd /etc/mongodb
mongosh --tls --tlsCAFile ./external-ca.crt --tlsCertificateKeyFile ./external-cert.pem

它之所以有效，是因为您在 mongod 配置中设置了 --tlsAllowInvalidCertificates，您可能会在 mongod 日志文件中找到一条警告消息。如果mongod 中没有--tlsAllowInvalidCertificates 选项，连接尝试应该会失败。

解释

您的 mongod 配置对应于此 openssl 客户端/服务器：

cd /etc/mongodb
# simulate mongod server:
openssl s_server -CAfile ./internal-ca.crt -cert ./external-cert.pem

## open another terminal ##

cd /etc/mongodb
# -> simulate connection from other replica set member:
openssl s_client -CAfile ./external-ca.crt -cert ./internal-cert.pem -quiet -no_ign_eof -status <<< Q
# Should be OK

# -> simulate connection from mongosh:
openssl s_client -CAfile ./external-ca.crt -cert ./external-cert.pem -quiet -no_ign_eof -status <<< Q
# Should fail

参数对tlsCAFile/tlsCertificateKeyFile和tlsClusterCAFile/tlsClusterFile是不是用于区分“正常”客户端连接（例如来自mongosh）和内部副本成员连接！它们用于分隔传入和外向的连接。

解决方案

假设您不创建专用的客户端证书，mongosh 连接应该是

cd /etc/mongodb
mongosh --tls --tlsCAFile ./external-ca.crt --tlsCertificateKeyFile ./internal-cert.pem

或者，如果您更喜欢使用专用客户端证书，则需要像这样对它们进行签名：

openssl x509 -in client-cert.csr -CA internal-ca.crt -CAkey internal-ca.key -out client-cert.crt  ...

mongosh --tls --tlsCAFile ./external-ca.crt --tlsCertificateKeyFile ./client-cert.pem

在How Security in MongoDB works (using x.509 cert)中查找更多详细信息