Cannot connect from JAVA to Mongo SSL Replica Set

Question

I am trying to configure the latest version of MongoDB using SSL encryption, I was able to connect from the mongo shell, but I get an error message when connecting with the Java client.

Work

mongo admin --host mongo1.xxxx.com --ssl --sslPEMKeyFile mongoClient.pem --sslCAFile mongoCA.crt

Does not work

public static void main(String args[]){ System.setProperty("javax.net.ssl.trustStore","/home/gasparms/truststore.ts"); System.setProperty("javax.net.ssl.trustStorePassword", "mypasswd"); System.setProperty("javax.net.ssl.keyStore", "/home/gasparms/truststore.ts"); System.setProperty("javax.net.ssl.keyStorePassword", "mypasswd"); System.setProperty("javax.security.auth.useSubjectCredsOnly","false"); MongoClientOptions options = MongoClientOptions.builder().sslEnabled(true) .build(); MongoClient mongoClient = new MongoClient("mongo1.xxxx.com",options); System.out.println(mongoClient.getDatabaseNames()); } 

I get this error from Mongo:

2015-06-09T15: 08: 14.431Z I NETWORK [initandlisten] connection accepted from 192.168.33.1lla8944 # 585 (3 connections are now open) 2015-06-09T15: 08: 14.445ZE NETWORK [conn585] there is no SSL certificate provided by an expert ; connection rejected 2015-06-09T15: 08: 14.445Z i NETWORK [conn585] end connection 192.168.33.1lla8944 (2 connections now open) 2015-06-09T15: 08: 14.828Z i NETWORK [conn580] end connection 192.168.33.13 : 39240 (1 connection open)

and in java client program

INFORMACIÓN: exception in the monitor stream when connecting to the server mongo1.xxxx.com:27017 com.mongodb.MongoSocketReadException: Prematurely reached the end of the stream com.mongb.connection.SocketStream.read (SocketStream.java:88) in com.mongodb.connection .InternalStreamConnection.receiveResponseBuffers (InternalStreamConnection.javaoors91) in com.mongodb.connection.InternalStreamConnection.receiveMessage (InternalStreamConnection.java:221) in com.mongodb.connection.CommandHelper.receiveReply (CommandHelper. Command13elper. connection.CommandHelper.receiveCommandResult (CommandHelper.java:121) in com.mongodb.connection.CommandHelper.executeCommand (CommandHelper.java:32) in com.mongodb.connection.InternalStreamConnectionInitializer.initializeConnectionConnectionomicodinal Internal .connection.InternalStreamConnectionInitializer.initialize (InternalStreamConnec tionInitializer.java:43) in com.mongodb.connection.InternalStreamConnection.open (InternalStreamConnection.java:115) in com.mongodb.connection.DefaultServerMonitor $ ServerMonitorRunnable.run (DefaultServerMonitor.java:127) in javarun.read (Thread.java:745)

Certificate Creation

I have mongoCA.crt and mongoClient.pem that works with the mongo shell. Then, I want to import .pem and .crt into java keystore

 openssl x509 -outform der -in certificate.pem -out certificate.der keytool -import -alias MongoDB-Client -file certificate.der -keystore truststore.ts -noprompt -storepass "mypasswd" keytool -import -alias "MongoDB-CA" -file mongoCA.crt -keystore truststore.ts -noprompt -storepass "mypasswd" 

What am I doing wrong?

Answer 1

I had the same problem and for me it turned out to be a problem with how I created the keystore. I noticed that you are using the same file, truststore.ts, both for trust and for keystore. This may work, but I would suggest using separate files to avoid confusion.

I have already created .pem files for the root certification authority and for the mongo user, and have been able to successfully use them to connect to the mongo shell. From those that I created truststore.jks and keystore.jks.

First, to create truststore.jks, I ran:

 keytool -import -alias root -storepass mypass -keystore truststore.jks -file rootca.pem -noprompt 

For keystore.jks, you need both public and private keys, so first convert the PEM file to PKCS12 format, and then import into JKS:

 openssl pkcs12 -export -out myuser.pkcs12 -in myuser.pem -password pass:mypass keytool -importkeystore -srckeystore myuser.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS -deststorepass mypass -srcstorepass mypass