Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-35587

Cannot connect to MongoDB using SSH tunnel and SSL

    • Type: Icon: Bug Bug
    • Resolution: Works as Designed
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: 3.4.9
    • Component/s: Security, Shell
    • None
    • Environment:
      Client - MongoDB v3.4.2 on Windows 10 64 bit
      Server - RHEL 7.3 64 bit, MongoDB v3.4.9
      Replica set with 1 primary, 1 secondary in one data center, 2 secondaries in another data center and an arbiter in another data center.

      Steps followed:
      1. Create SSH tunnel to all 5 servers using following commands.

      start plink -N -pw %UnixPassword% -L 50021:mongohost1.mycompany.com:27017 %USERNAME%@mongohost1.mycompany.com
      start plink -N -pw %UnixPassword% -L 50022:mongohost2.mycompany.com:27017 %USERNAME%@mongohost2.mycompany.com
      start plink -N -pw %UnixPassword% -L 50023:mongohost3.mycompany.com:27017 %USERNAME%@mongohost3.mycompany.com
      start plink -N -pw %UnixPassword% -L 50024:mongohost4.mycompany.com:27017 %USERNAME%@mongohost4.mycompany.com
      start plink -N -pw %UnixPassword% -L 50025:mongohost5.mycompany.com:27017 %USERNAME%@mongohost5.mycompany.com
      

      2. Use following command to connect to replica set.

      C:\Users\zendu>mongo -u myuser -p "mypassword" --authenticationDatabase mydb --ssl --sslCAFile C:\Users\zendu\Documents\certificates\UAT\mongodb\ca.pem --sslPEMKeyFile C:\Users\zendu\Documents\certificates\UAT\mongodb\qaserver.pem --sslPEMKeyPassword pempassword --sslAllowInvalidHostnames 
      localhost:50021,localhost:50022,localhost:50023,localhost:50024,localhost:50025/mydb?replicaSet=RS_QA
      

      Mongo shell fails with following output

      MongoDB shell version v3.4.2
      connecting to: mongodb://localhost:50021,localhost:50022,localhost:50023,localhost:50024,localhost:50025/dbgbcq1?replicaSet=RS_QA
      2017-10-30T03:08:39.772-0700 I NETWORK  [thread1] Starting new replica set monitor for RS_QA/localhost:50021,localhost:50022,localhost:50023,localhost:50024,localhost:50025
      2017-10-30T03:08:40.577-0700 W NETWORK  [thread1] The server certificate does not match the host name. Hostname: localhost does not match SAN(s): mongohost1.mycompany.com
      2017-10-30T03:08:40.986-0700 W NETWORK  [ReplicaSetMonitor-TaskExecutor-0] The server certificate does not match the host name. Hostname: localhost does not match SAN(s): mongohost2.mycompany.com
      2017-10-30T03:08:41.909-0700 I NETWORK  [ReplicaSetMonitor-TaskExecutor-0] changing hosts to RS_QA/mongohost1.mycompany.com:27017,mongohost2.mycompany.com:27017,mongohost3.mycompany.com:27017,mongohost4.mycompany.com:27017 from RS_QA/localhost:50021,localhost:50022,localhost:50023,localhost:50024,localhost:50025
      2017-10-30T03:08:46.229-0700 W NETWORK  [thread1] Failed to connect to 10.196.100.30:27017 after 5000ms milliseconds, giving up.
      2017-10-30T03:08:49.362-0700 W NETWORK  [ReplicaSetMonitor-TaskExecutor-0] Failed to connect to 10.196.100.31:27017 after 5000ms milliseconds, giving up.
      2017-10-30T03:08:54.995-0700 W NETWORK  [thread1] Failed to connect to 10.196.100.30:27017 after 5000ms milliseconds, giving up.
      2017-10-30T03:09:00.217-0700 W NETWORK  [thread1] Failed to connect to 10.196.100.31:27017 after 5000ms milliseconds, giving up.
      2017-10-30T03:09:00.229-0700 W NETWORK  [thread1] No primary detected for set RS_QA
      2017-10-30T03:09:06.057-0700 W NETWORK  [thread1] Failed to connect to 10.196.100.30:27017 after 5000ms milliseconds, giving up.
      2017-10-30T03:09:11.276-0700 W NETWORK  [thread1] Failed to connect to 10.196.100.31:27017 after 5000ms milliseconds, giving up.
      2017-10-30T03:09:11.288-0700 W NETWORK  [thread1] No primary detected for set RS_QA
      2017-10-30T03:09:11.306-0700 E QUERY    [thread1] Error: could not find host matching read preference { mode: "primary", tags: [ {} ] } for set RS_QA :
      connect@src/mongo/shell/mongo.js:237:13
      @(connect):1:6
      exception: connect failed
      

            Assignee:
            nick.brewer Nick Brewer
            Reporter:
            zendu Zendu
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: