4

Following instructions outlined in MongoDB SSL encryption and Spring's Driver, I got 2.1.0 and after building it, it says it doesn't recognize sslOnNormalPorts, sslPEMKeyFile or sslPEMKeyPassword.

But I saw a --keyFile, and used it (I had to strip out the leading and trailing -----BEGIN RSA PRIVATE KEY---- and -----END RSA PRIVATE KEY----, and trailing '==' from the Base64 encoded key).

Now if I launch the mongo shell, all my commands work fine (show dbs, use xyz, db.abc.find() etc.)

If I try to specify host and port I get:

mongo --host 192.168.1.100 --port 27017 MongoDB shell version: 2.1.0 connecting to: 192.168.1.100:27017/test

show dbs Mon Apr 30 21:37:37 uncaught exception: listDatabases failed:{ "errmsg" : "need to login", "ok" : 0 }

If I add --ssl flag to launch mongo shell, it just hangs. While mongod spits out:

Mon Apr 30 21:40:53 [initandlisten] options: { keyFile: "/Users/tshrestha/Downloads/key.pem" }
Mon Apr 30 21:40:53 [initandlisten] journal dir=/data/db/journal
Mon Apr 30 21:40:53 [initandlisten] recover : no journal files present, no recovery needed 
Mon Apr 30 21:40:53 [websvr] admin web console waiting for connections on port 28017
Mon Apr 30 21:40:53 [initandlisten] waiting for connections on port 27017
Mon Apr 30 21:41:16 [initandlisten] connection accepted from 192.168.1.102:64413 #1 (1 connection now open)
Mon Apr 30 21:41:53 [clientcursormon] mem (MB) res:14 virt:2419 mapped:0

I am on Mac OSX 10.7

1 Answer 1

1

The keyfile option is for authentication between mongod instances, not SSL - it is treating your stripped down SSL key as simply a string of characters. What you have there is a really long password, nothing more. See here for more info:

http://www.mongodb.org/display/DOCS/Security+and+Authentication

You are missing the piece where you have to recompile using scons with the ssl flag. Re-read this page:

http://www.mongodb.org/display/DOCS/Building+for+OS+X

You need to follow the instructions there until you get to the part where it says this:

scons all

For an SSL enabled build you will need to use:

scons --ssl all

Once the build finishes, mongod will recognize your SSL related options. Note - I have done this on Mac OS X many times without a problem.

6
  • That is what I did.. scons --ssl all and then scond --ssl install: not sure if the second one is expected. May 2, 2012 at 20:53
  • Since 2.1.0 didn't recognize any of the --sslOnNormalPorts --sslPEMKeyFile <pem> --sslPEMKeyPassword <pass> options, I got and built 2.0.4. It seemed to accept those flags but still don't think it worked. May 2, 2012 at 20:55
  • my guess would be that the install didn't work and you weren't running the one you built with SSL enabled. I have used the method described on OS X and Linux without a hitch, but never an install (I was just running it from a folder directly). If 2.0.4 accepted the options then it would have started up with SSL and you would have had to use the --ssl option in order to connect - otherwise it would just reject the connection
    – Adam C
    May 2, 2012 at 23:55
  • It worked with two caveats: even if the certificate does not have a password I have to type garbage for --sslPEMKeyPassword and the file passed to --sslPEMKeyFile had to contain both CERTIFICATE and RSA PRIVATE KEY segments. My next step would be to see if mutual TLS is supported by Mongo. May 3, 2012 at 0:18
  • By mutual TLS, I meant exclusively so, clients must present there certificates. In which case, I would expect to see an option to specify the CA certificate. May 3, 2012 at 3:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .