如何为MongoDB副本集添加启用TLS连接的成员？

MongoDB官方文档完全未说明，当要添加的副本集成员启用TLS连接时该如何操作。我尝试了多种添加方式均失败：

rs0 [direct: primary] admin> rs.add({host: "mail.giftbutton.com:27017/?tls=true&tlsCAFile=/home/buryj/certsMongoMailer/intermRoot.pem&tlsCertificateKeyFile=/home%2Fburyj/certsMongoMailer/clientKey.pem"})
MongoServerError[InvalidReplicaSetConfig]: member: { host: "mail.giftbutton.com:27017/?tls=true&tlsCAFile=/home/buryj/certsMongoMailer/intermRoot.pem&tlsCertificateKeyFile=/home%2Fburyj/certsMongoMailer/clientKey.pem", _id: 1 } :: caused by :: Did not consume whole string.
rs0 [direct: primary] admin> rs.add({host: "mail.giftbutton.com --tls --tlsCAFile /home/buryj/certsMongoMailer/intermRoot.pem --tlsCertificateKeyFile /home/buryj/certsMongoMailer/clientKey.pem"})
MongoNetworkError: connection 2 to 51.89.216.247:27017 closed
admin> rs.add({host: "mail.giftbutton.com --tls --tlsCAFile=/home/buryj/certsMongoMailer/intermRoot.pem --tlsCertificateKeyFile=/home/buryj/certsMongoMailer/clientKey.pem"})
MongoNetworkError: connection 4 to 51.89.216.247:27017 closed

出现“连接关闭”提示时，主节点直接崩溃。

补充信息 #

• 仅待添加的副本集成员（mail.giftbutton.com）配置了net.clusterFile和security.clusterAuthMode，当前主节点（giftbutton.com）未配置这些参数，除非必须添加。
• 用于tls.clusterFile的clientKey.pem证书（不含完整私钥）：

-----BEGIN CERTIFICATE-----
MIIFoTCCA4mgAwIBAgIUL8LPPEuTdqrGlAtwbbwvZQClIZQwDQYJKoZIhvcNAQEL
BQAwWTELMAkGA1UEBhMCQVUxGjAYBgNVBAoMEWdpZnRidXR0b24gbWFpbGVyMRQw
EgYDVQQLDAtNeSBEaXZpc2lvbjEYMBYGA1UEAwwPSW50ZXJtZWRpYXRlIENBMB4X
DTI0MTIxNjExMjYxOFoXDTM0MTIxNDExMjYxOFowVjELMAkGA1UEBhMCQVUxGjAY
BgNVBAoMEWdpZnRidXR0b24gbWFpbGVyMRQwEgYDVQQLDAtNeSBEaXZpc2lvbjEV
MBMGA1UEAwwMTW9uZ28gQ2xpZW50MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
CgKCAgEA1+pVpayZCqZkx1oK5b+S7BLYAynReYz2b4Wtl23zf24Ydp2cNomZ8xs5
sPJicn26kIqJNr26nRHPmMFQGLqY51UXR76s/Je/pe6KQcjCLab59fHtjvGkSK+Z
ONqJpxHhRgTD6WiDC/hapXh3XS5gp5Q4sg8l3uy0qkOSJBAVfqJXa+QspDcSrPpX
2iR9DWxw7DMzYyOlS5xISbZQFzQszisSJ6JPrMjljWgAqjUZ6JDqRSSzCG8Wzua0
HVTO26/CUnv/xYS96cBwhCQ2iosYjTeO+FYaUW0Su704wLs0weAoT8bwRC/R86qG
3wOa8uhxJymE1M1AX5Hkn/6IBk8c/pbUCBEWTa86mCJIhWC+UzaRJsL/nk46Rz7Z
hMx4vtDBGzaUSpur2n5dvRe/sNU4Rn61ps0eiVUdKB0d9kexXB+VOtCfp58A8gCx
UNitBafXXjcHSTAcxDXLSXlhjsVMNw5CId6p6ny4NkclBVhCRgGZWgR4lH0jx6Wd
YFbFIm17xFypPQ/rjPwe+ZfMEMGrgtZGFIRLXFSyRQ2LEGSmnDhM0kXmKdTBqBQq
8kFmMIaD5FqiZ9Ujr8xkJy0XiFM+kNhmdBnCt6FOdeB/GBPW+kbOEXeerjuicA1T
zRPvkmGzmXXEpwh3sDjJNvikR/aIXztj8em8ih0X9gkls1V7dMMCAwEAAaNkMGIw
CwYDVR0PBAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBQcWG8F
PS/w4Lu560eIFCHRLFRV2jAfBgNVHSMEGDAWgBSKHwUqH943eitOLZQcwJHeY58T
0TANBgkqhkiG9w0BAQsFAAOCAgEASNhKXenuJfTqBjfn6SS7phCVshMnV/FSQ14Y
f6DJlw87fOYh8HBbU27DK1usyr7w0x/Bbe9ERqflQR4gLGrvdt2rUdkn5FXzAfUq
9ml5DwL7b0PUiYTGvGmoG5xbFuVn6IiGAloKiBFES5esdBOmS955QXBb/eb39jGA
pcoaZDqbqh6QD+poRqYD21r0LfZQBS8O1Sl/uszyRLV7/GTgjq6CEnXMzfotoPKI
OPeXwk2C/e9RgU/aW/qq0lUg77kDbJ/oHFppuZ7a5mePharvjM8cuFHNbAlgteHB
kX8IiHdWPkG6O7YREcjX+42ZJFEOGJJzwYYTiQzeUXpi8CJkKlmzmh9KOCzNbMgk
o5EqhUG2MeU1kN7fKXOKa2EUIU9uqVGko3PvMLnHDz8lPM9JvxCy41TgXBLtcrNt
78tgGkJolhJ+5sAeyD5MTPuj43AX8i3OoV6iYXIJHc32U1NEWNo4gvyrJ2crRu/A
x9egN31obRYez0xCOEWEUiUtbhxaoF6FDh+nvP7OAMZ2aubsZ0HFN4VxpwnV8Gtr
c+UTyA6f9MplfyzMUS4FHHJvJMaOGM7EihSTAvGCdx+jmEf7iStgtU0B2IAkXvkE
1XLuH7jPOY6fT8dTMOu/IRzsgE3epSL4WRm5JeLw8WvsYf2mdTHCCIqHNkEJ8vtH
EdDxstY=
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----

• 待添加节点的mongod.conf部分配置：

net:
  port: 27017
  bindIpAll: true
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/openSSL/serverKey.pem
    CAFile: /etc/ssl/openSSL/intermRoot.pem
    clusterFile: /etc/ssl/openSSL/clientKey.pem

security:
  keyFile: /etc/mongodKeyfile
  clusterAuthMode: keyFile

解决方案 #

1. 统一副本集节点的TLS配置
   副本集内所有节点必须使用一致的TLS配置才能正常通信，主节点也需要添加对应配置：

   • 在主节点的mongod.conf中添加TLS参数，和待添加节点保持相同的CAFile、certificateKeyFile，设置net.tls.mode为requireTLS（或根据需求调整为preferTLS）。
   • 确保主节点上证书路径存在且权限正确。

2. 正确执行rs.add()命令
   无需在host字段中携带TLS参数，节点间通信会自动使用mongod.conf中的配置：

   rs.add({host: "mail.giftbutton.com:27017", _id: 1})
   

   注意：_id需在副本集中唯一。

3. 提前验证TLS连通性
   在主节点上用客户端测试与待添加节点的TLS连接：

   mongo "mongodb://mail.giftbutton.com:27017" --tls --tlsCAFile /path/to/intermRoot.pem --tlsCertificateKeyFile /path/to/clientKey.pem
   

   连接成功后再执行添加操作。

4. 同步集群认证模式
   待添加节点设置了clusterAuthMode: keyFile，主节点也需保持相同配置，避免因认证不一致导致连接崩溃。

内容的提问来源于stack exchange，提问作者jurijus01