Who can explain mongodb with ssl?

Question

I created certificates according to the instructions on the official website of MongoDB, but it doesn't work properly.

I have a replica set and self-signed certificates.

I need a full encryption of traffic between replica members. How do I properly set up these replica members? And how do I enter the MongoDB shell?

I created certificates according to the instructions, in mongod.conf:

sslMode = requireSSL
sslPEMKeyFile = /etc/ssl/mongo.pem ...

and try the add the parameter:

sslCAFile = /etc/ssl/mongo.crt

and tried to enter:

mongo --ssl --sslPEMKeyFile /etc/ssl/mongo.pem --sslCAFile /etc/ssl/mongo.pem or 
mongo --ssl --sslPEMKeyFile /etc/ssl/mongo.pem --sslCAFile /etc/ssl/mongo.crt 

I get the error - The server certificate does not match the host name.

If I use the client certificate then error: SSL peer certificate validation failed:self signed certificate.

the Mongod service is up and running. Mongo version - 3.0.2. Centos - 6.5 x64.

I went through a lot of links but haven't found a working solution.

If it is possible can you please give me the steps?

Answer 1

When you create the self signed certificate, you need to use a valid host name in the "Common Name" field, e.g.:

Common Name (eg, your name or your server's hostname) []: host.domain.com

If you want use a domain certificate, you need to change "host" with "*", e.g.:

Common Name (eg, your name or your server's hostname) []: *.domain.com

Answer 2

You can force mongo to ignore the certificate hostname mismatch with the allowInvalidHostnames configuration option

net.ssl.allowInvalidHostnames

Type: boolean

Default: False

New in version 3.0.

When net.ssl.allowInvalidHostnames is true, MongoDB disables the validation of the hostnames in TLS/SSL certificates, allowing mongod to connect to MongoDB instances if the hostname their certificates do not match the specified hostname.

Changed in version 3.0: Most MongoDB distributions now include support for TLS/SSL. See Configure mongod and mongos for TLS/SSL and TLS/SSL Configuration for Clients for more information about TLS/SSL and MongoDB.

• Erik: This answer would be improved if you abstracted a summary of the relevant portions of the linked web page.