mongodump error: x509: cannot validate certificate for <server-IP> because it doesn't con-CodePudding

I am trying to setup mongodump along with TLS/SSL encryption. I have been following various articles for this: Self-signed SSL connection using PyMongo, https://mydbops.wordpress.com/2020/05/02/securing-mongodb-cluster-with-tls-ssl/ and some more.

So, I have generated the CA certificates.

#Create CA Private Certificate
openssl genrsa -passout pass:<password> -out ca.key -aes256 8192
 
#Sign CA Public Certificate
openssl req -x509 -new -extensions v3_ca -passin pass:<password> -key ca.key -days 365 -out ca-pub.crt -subj "/C=XX/L=Default City/O=Default Company Ltd"

Then, created a key for the MongoDB server and self signed it using the CA.

openssl req -nodes -newkey rsa:4096 -sha256 -keyout mongod.key -out mongod.csr -subj "/C=XX/L=Default City/O=Default Company Ltd/CN=<host-name-IP>";
openssl x509 -req -in mongod.csr -CA ca-pub.crt -passin pass:<password> -CAkey ca.key -CAcreateserial -out mongod.crt;
cat mongod.key mongod.crt > mongod.pem;

Next, I created a conf file for the client with contents as:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
default_keyfile = mongo-client.key
prompt = no

[req_distinguished_name]
C = filled-appropriately
ST = filled-appropriately
L = filled-appropriately
O = client
OU = client-team
CN = .

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = IP:<mongodb-server-ip>

Next, using this .conf file, generated a mongo client csr file

openssl req -new -nodes -out mongo-client.csr -config mongo-client.conf

Then, self signed these using the CA certificate.

openssl x509 -req -in mongo-client.csr -CA ca-pub.crt -CAkey ca.key -out mongo-client.crt
cat mongo-client.key mongo-client.crt > mongo-client.pem

I have placed the CA and MongoDB server specific files at appropriate locations(in /etc/ssl) and updated the paths in the mongod.conf file

  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/ca-pub.crt

After updating, performed a daemon-reload and restarted the mongod.service, and moved the ca-pub.crt and mongo-client.pem to the appropriate client server.

Now, when I try connecting to the server using the mongo command, it gets connected successfully.

mongo --tls --tlsCAFile ca-pub.crt --tlsCertificateKeyFile mongo-client.pem --host=<server-IP> -u <username> -p <password>

But, when I try running the mongodump command:

mongodump --host=<server-IP> -u <username> -p <password> --ssl --sslCAFile=ca-pub.crt --sslPEMKeyFile=mongo-client.pem

It gives this error:

2022-03-23T13:17:29.698 0000    Failed: can't create session: could not connect to server: server selection error: server selection timeout, current topology: { Type: Single, Servers: [{ Addr: <server-IP>, Type: Unknown, State: Connected, Average RTT: 0, Last error: connection() : x509: cannot validate certificate for <server-IP> because it doesn't contain any IP SANs }, ] }

Note: In all the above codes, the value of server-IP has been added appropriately.

Can anyone provide the solution for this or any resource which would be helpful. Any help would be appreciated. Thanks.

CodePudding user response：

The SubjectAltName is different from what I have used in the past.

Create a common Signing Request

echo '[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name

[ req_distinguished_name ]' | sudo tee common.csr.conf

openssl req -nodes -sha256 -newkey rsa:4096 -keyout node1.key.pem -out node1.csr -subj "/C=US/ST=Oregon/L=Springfield/O=Some Organization/OU=Replicaset/CN=node1" -config common.csr.conf

Create an extension file

echo '
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth, emailProtection
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = node1.barry.test
IP.1 = 127.0.0.1' | sudo tee node1.ext

Sign the Cert

openssl x509 -req -sha256 -in node1.csr -CA ca.crt.pem -CAkey ca.key.pem -CAcreateserial -days 365 -out node1.crt.pem -extfile node1.ext

Combine cert and key into a PEM file

cat node1.key.pem node1.crt.pem > node1.pem

CodePudding user response：

I referred this link to fix the issue: https://security.stackexchange.com/questions/74345/provide-subjectaltname-to-openssl-directly-on-the-command-line/183973?newreg=1aa964f1090e49029f2ee664382e75e4

openssl req -newkey rsa:4096 -nodes -out server.csr -keyout server.key -subj "/C=XX/ST=XX/L=XX/O=company/OU=company-unit/CN=<server-IP>";
 
openssl x509 -sha256 -req -extfile <(printf "subjectAltName=IP:<server-IP>") -days 365 -in server.csr -CA ca.pem -passin pass:password -CAkey ca_private.pem -CAcreateserial -out server-signed.crt;
 
cat server-signed.crt server.key > server.pem;

Rest of the steps related to creation of the CA certificates and the client keys are same.

@barrypicker's answer worked to solve the mongodump and mongorestore issue, but the connecting to the mongo shell was failing then.