0

System Info:

  • Microsoft Windows 2016 Server on an Azure VM.
  • MongoDB Community Edition 3.6 (with SSL)
  • OpenSLL 1.1.0g 2 Nov 2017
  • Compass Community 1.11.1

Issue: I can connect from a remote workstation using the command line Mongo but I can't connect using Compass Community Edition. I'm using a self-signed certificate created by OpenSSL for testing. Hopefully, when I figure all this out, I'll get an "officially" provided cert from Microsoft or Network Solutions.

Basic Request for Help: Please help me figure out how to login to the MongoDB server using the Compass UI.

Compass Error:

Could not connect to MongoDB on the provided host and port

Mongo Log Error:

2018-03-08T13:12:39.365-0600 I NETWORK  [listener] connection accepted from MYLOCALIP:62794 #127 (1 connection now open)
2018-03-08T13:12:39.392-0600 E NETWORK  [conn127] no SSL certificate provided by peer; connection rejected
2018-03-08T13:12:39.392-0600 I NETWORK  [conn127] Error receiving request from client: SSLHandshakeFailed: SSLHandshakeFailed. Ending connection from MYLOCALIP:62794 (connection id: 127)
2018-03-08T13:12:39.392-0600 I NETWORK  [conn127] end connection MYLOCALIP:62794 (0 connections now open)

Steps I did (for reference).

Note that I prepared the directory with the following prior to running the OpenSSL commands:

echo 00 > file.srl
echo 01 > serial
fsutil file createnew index.txt 0
fsutil file createnew index.txt.attr 0

Create the certificates: reference.

// CA - KEY

openssl genrsa -aes256 -out ca.key.pem 4096 -days 3650 -subj "/C=US/ST=Tennessee/O=CompanyName/CN=root/emailAddress=myname@mycompany.com"

// Server Key

openssl genrsa -out server.key 2048

// Loclhost working (for reference that I did this to test locally first)

// Create the server certificate signing request (CSR)

openssl req -key server.key -new -out server.req -subj  "/C=US/ST=Tennessee/O=CompanyName/CN=Server/CN=127.0.0.1/emailAddress=myname@mycompany.com"

// Create the certificate, signed by the cA

openssl x509 -req -in server.req -CA ca.cert.pem -CAkey ca.key.pem -CAserial file.srl -out server.crt -days 3650

// Mongo needs a certificate that is the combination of the private key plus the certificate concatinated

type server.key server.crt > server.pem

// Test the certificate to see if it is okay

openssl verify -CAfile ca.cert.pem server.pem

I found that in order to connect remotely, I had to create a "remote" certificate that had the IP address of the Windows server running MongoDB. Here are all the steps without any comments. They are exactly as the local but with minor changes as shown:

// Remote working IP xx.xxx.xx.xx
openssl req -key server.key -new -out remote_server.req -subj  "/C=US/ST=Tennessee/O=CompanyName/CN=Server/CN=xx.xxx.xx.xx/emailAddress=myname@mycompany.com"
openssl x509 -req -in remote_server.req -CA ca.cert.pem -CAkey ca.key.pem -CAserial file.srl -out remote_server.crt -days 3650

type server.key remote_server.crt > remote_server.pem
openssl verify -CAfile ca.cert.pem remote_server.pem

Now, I needed a client:

// Client

openssl genrsa -out client.key 2048
openssl req -key client.key -new -out client.req -subj "/C=US/ST=Tennessee/O=CompanyName/CN=Client/emailAddress=myname@mycompany.com"
openssl x509 -req -in client.req -CA ca.cert.pem -CAkey ca.key.pem -CAserial file.srl -out client.crt -days 3650
type client.key client.crt > client.pem
openssl verify -CAfile ca.cert.pem client.pem

With this completed, I set my mongodb.conf file as follows:

systemLog:
  verbosity: 0
  destination: file
  path: "D:\\MongoLogs\\mongolog.log"
  logAppend: true
storage:
  dbPath: "D:\\MongoData"
security:
  authorization: enabled
net:
  port: 27017
  bindIpAll: true
  ssl:
    mode: requireSSL
    PEMKeyFile: "D:\\remote\\remote_server.pem"
    CAFile: "D:\\remote\\ca.cert.pem"

Note that I would replace remote_server.pem with server.pem if I want to connect from the server as a client to the server.

On the server, I start MongoDB with the following:

mongod --dbpath D:\MongoData\ --logpath D:\MongoLogs\mongolog.log --logappend --config D:\MongoConfig\mongo.conf

Now, I switch from the server to my local machine which is not on Azure or anything, but it does have Internet access and MongoDB is also installed on this system. I then run this command-line:

mongo xx.xxx.xx.xx -u AdminUserName -p AdminPassword --authenticationDatabase admin -ssl -sslCAFile E:\tmp4\ca.cert.pem --sslPEMKeyFile E:\tmp4\client.pem

Here's the success with the command-line connection:

MongoDB shell version v3.6.2
connecting to: mongodb://xx.xxx.xx.xx:27017/test
MongoDB server version: 3.6.3
Server has startup warnings:
2018-03-08T12:31:03.774-0600 I CONTROL  [initandlisten]
2018-03-08T12:31:03.774-0600 I CONTROL  [initandlisten] ** WARNING: The file system cache of this machine is configured to be greater than 40% of the total memory. This can lead to increased memory pressure and poor performance.
2018-03-08T12:31:03.774-0600 I CONTROL  [initandlisten] See http://dochub.mongodb.org/core/wt-windows-system-file-cache
2018-03-08T12:31:03.774-0600 I CONTROL  [initandlisten]
>

Likewise, the log shows a connection made:

2018-03-08T13:47:00.023-0600 I NETWORK  [conn128] received client metadata from MYLOCALIP:63346 conn: { application: { name: "MongoDB Shell" }, driver: { name: "MongoDB Internal Client", version: "3.6.2" }, os: { type: "Windows", name: "Microsoft Windows 10", architecture: "x86_64", version: "10.0 (build 16299)" } }
2018-03-08T13:47:00.093-0600 I ACCESS   [conn128] Successfully authenticated as principal DBAdminUserName on admin

At this point, basic commands like db.help() and such work.

All is good. Now, I think, "Let's connect with Compass!"

No matter what combination I try, it fails. Here's the basic info:

enter image description here

Can anyone please help me figure out what I need to do to get the Compass UI to login?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.