Getting MongooseServerSelectionError: Hostname/IP does not match certificate's altnames: IP: xxx.xx.xx.xx is not in the cert's list:

Question

我在我的 linux 机器上创建了自签名证书，我给的证书 CN 与 linux 的 IP 相同我已将它们添加到 mongodb.conf 并重新启动了服务器我可以通过命令连接

mongo --ssl --sslPEMKeyFile /etc/ssl/mongodbcerts/mongodb.pem --sslCAFile /etc/ssl/mongodbcerts/ca.pem

但是当我尝试从 nodeJS 连接时 mongoose 我收到类似

的错误

MongooseServerSelectionError：Hostname/IP 与证书的别名不匹配：IP：XXX.xx.x.xx 不在证书列表中：

我的nodejs连接mongodb的代码如下

const connectionOptions = { useCreateIndex: true,
     useNewUrlParser: true, 
     useUnifiedTopology: true,
     useFindAndModify: false ,
     server:{
    ssl: true,
    sslValidate:true,
    sslCA: require('fs').readFileSync("/etc/ssl/mongodbcerts/ca.pem"),
    sslKey:require('fs').readFileSync("/etc/ssl/mongodbcerts/mongodb.key"),
    sslCert:require('fs').readFileSync("/etc/ssl/mongodbcerts/mongodb.crt")
            }
};

let mongo_url="mongodb://username:password@IPaddress/DB"
console.log(mongo_url)
mongoose.connect(mongo_url,connectionOptions).then(() => console.log( 'Database Connected' ))
.catch(err => console.log( err ));;

请告知错误

Answer 1

我犯的错误是我创建了使用通用名称 (CN) 作为 IP 地址 (XXX.xx.x.xx) 的自签名证书，但我们需要创建使用 CN 作为主机名的自签名证书。要获取主机名，请打开 mongo shell 并执行以下命令：

>getHostName()

您将使用该 VM 的主机名并创建具有相同主机名的自签名证书并尝试连接 mongoose nodejs。它会起作用。支持文档：https://mongoosejs.com/docs/tutorials/ssl.html

Answer 2

我最近遇到了this issue。从MongoDB 4.2开始，在进行SAN比较时，MongoDB也支持IP地址比较。您可以在 CN 字段中使用 IP 地址，但请确保您的 openssl 配置文件在 alt_names 部分包含您的服务器 IP 地址。

这是官方 MongoDB 文档中提供的示例 cnf 文件 -

# NOT FOR PRODUCTION USE. OpenSSL configuration file for testing.


[ req ]
default_bits = 4096
default_keyfile = myTestServerCertificateKey.pem    ## The default private key file name.
default_md = sha256
distinguished_name = req_dn
req_extensions = v3_req

[ v3_req ]
subjectKeyIdentifier  = hash
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
nsComment = "OpenSSL Generated Certificate for TESTING only.  NOT FOR PRODUCTION USE."
extendedKeyUsage  = serverAuth, clientAuth
subjectAltName = @alt_names

[ alt_names ]
DNS.1 =         ##TODO: Enter the DNS names if using hostname, otherwise remove this line
IP.1 =          ##TODO: Enter the IP address if using IP address

[ req_dn ]
countryName = Country Name (2 letter code)
countryName_default = TestServerCertificateCountry
countryName_min = 2
countryName_max = 2

stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = TestServerCertificateState
stateOrProvinceName_max = 64

localityName = Locality Name (eg, city)
localityName_default = TestServerCertificateLocality
localityName_max = 64

organizationName = Organization Name (eg, company)
organizationName_default = TestServerCertificateOrg
organizationName_max = 64

organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = TestServerCertificateOrgUnit
organizationalUnitName_max = 64

commonName = Common Name (eg, YOUR name)
commonName_max = 64

Getting MongooseServerSelectionError: Hostname/IP does not match certificate's altnames: IP: xxx.xx.xx.xx is not in the cert's list:

Getting MongooseServerSelectionError: Hostname/IP does not match certificate's altnames: IP: xxx.xx.xx.xx is not in the cert's list:

openssl

ssl-certificate

mongoose

mongodb

node.js