添加带TLS连接的MongoDB副本集成员时遇证书错误求助

环境与操作背景 #

• 主节点：giftbutton.com
• 待加入副本集节点：mail.giftbutton.com
• 已完成前置操作：所有节点间共享keyFile与clusterKey.pem文件

节点配置（mongo.conf） #

net:
  port: 27017
  bindIpAll: true
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/openSSL/serverKey.pem
    CAFile: /etc/ssl/openSSL/intermRoot.pem
    clusterFile: /etc/ssl/openSSL/clusterKey.pem

security:
  keyFile: /etc/mongodKeyfile
  clusterAuthMode: keyFile

clusterKey.pem证书内容（不含私钥） #

-----BEGIN CERTIFICATE-----
MIIFxTCCA62gAwIBAgIUFQqriR7b+rYs7XpQS5qSlPkkWowwDQYJKoZIhvcNAQEL
BQAwUjELMAkGA1UEBhMCQVUxEzARBgNVBAoMCmdpZnRidXR0b24xFDASBgNVBAsM
C015IERpdmlzaW9uMRgwFgYDVQQDDA9JbnRlcm1lZGlhdGUgQ0EwHhcNMjQxMjE3
MjMxMzIwWhcNMzQxMjE1MjMxMzIwWjBPMQswCQYDVQQGEwJBVTETMBEGA1UECgwK
Z2lmdGJ1dHRvbjEUMBIGA1UECwwLTXkgRGl2aXNpb24xFTATBgNVBAMMDE1vbmdv
IFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJjgkXeGEFus
nQb+T7epIWqR+N/LZSZmbOiwpzAmlRv8jC5qU4rIEA4HiFu20uC6OS/dpohCvF7L
vufIS5qB+LVC05Z8NcVvDz1ksnV8jtoCO666t0bCEVina1wCyMDUmrb5H44P52wf
FKEFYvO1meQ54yowsaagzJgWnngZuxg0TWVdGuJJS4+xdymg5QORlSRJ3e9Q6A94
rb2Lzfd3vCVQo/h1YgwUsZ/N+ZFwA3rQ2M+tM+ScdUAjQGi+tlvG/MmRRiA9zLP+
NOZgPbwOSD0Dd4i9Lfs+lbloXEUNuCzOkQhw3QTBLcjplabJdZ+C7gnkUzYLJhkt
aeKfe0YgEfMsv+1XyARG8jneYclktR2aClH27ame6PWoTD4heJg9xYcRIW8X8Pmj
W0SXEv6I1PbNzu8U3wwsDHE30hh0wxPiqaK6+jG7yHYscUM3Uu8CiFh9H0nlnFaA
1fMKNAMz48519TbaeKKj9Sl0HI08d8SHk3huNRERBrV7jlHXllYB/UWptxTeiWKn
vcOmIPg1Jgrvu4MFdOVQS29nw9P8AmBlJw2Rz0XC0N0Ih4KD7PINIIN7F6OGtLmm
VzrCXKszYPt+U5BE97wZ313CNnHV+mfABS6+nHdWFgPLR8EPAGOnwOrobGDNAPlX
lCOWKNsiBlH6vtJ7DtSGorISjEIFHrQzAgMBAAGjgZUwgZIwCwYDVR0PBAQDAgWg
MBMGA1UdJQQMMAoGCCsGAQUFBwMCMC4GA1UdEQQnMCWCDmdpZnRidXR0b24uY29t
ghNtYWlsLmdpZnRidXR0b24uY29tMB0GA1UdDgQWBBQANMJiNmSYVYrUxd/oJtBz
KH8jazAfBgNVHSMEGDAWgBQLAfqtUBpFgcRNbqa6GZ1y5K9UmzANBgkqhkiG9w0B
AQsFAAOCAgEAsHrKzrAMQ5UCKntvBCVCCsAonTNq5AUGB6kta/lCQnFv0+twD7ZR
vWNDUQMPmNGgPDOKu3qSfZkZgxRi4BotHYI54DR3GrVTX3Kv6x3w0ODg8JKmYfuE
HmTJUsLjv3LyugE/dIR/ocPXoNwD9NssIQuyk9SwM74OoDahC5tAMfve2ZEAdZKl
Uz8oiiEbVlhNRH0QLvMI3pFeW7MMjuCOKpZsVwLb+mbaURp8UpGiaUj+NWSsX/O/
Ddm6QzvdMk/IFedT5mnM2FIVQkEO9hmx3fAwgi3/vC3oeBGB+xbvMlpn9kw+mbX3
tuIM+0Km0t+x20quGkyFXOe2z3DQr85EQ9GAnTfhSHDw8g+HZ4eLYNBG2FylOr7h
tDPnHXO5eM9w5xUcw2Vhi456s/PSCK/17mdnrAJU1Mj8+h42PgYM3z23P4QhWzKZ
EXVL1pu5EfcFndERAXLwUNGhmm2aIzfNGsvENdNuhVmHoyxuOWwoKxk8fDWcduBc
RXjfAKgSQxe9gKrHuUSx1Gmk9e/OO3Fbl7QCWmPZKOXbG+/oR8tyHzxQLZ+Xk1z9
uQlfA0akjJeszOuIuCNDHhUmQVDgcnSAEVH3w0uZBGxG0f8oZij4aXpmtTqpAgxP
T9y0boxjkuhb6SILlcHh+9u2/VAZ8jIDWzAlJE1miTU6xVMESH6YSF4=
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----

错误日志 #

主节点giftbutton.com日志 #

{"t":{"$date":"2024-12-17T23:46:05.920+00:00"},"s":"I",  "c":"REPL_HB",  "id":23974,   "ctx":"ReplCoord-3","msg":"Heartbeat failed after max retries","attr":{"target":"mail.giftbutton.com:27017","maxHeartbeatRetries":2,"error":{"code":6,"codeName":"HostUnreachable","errmsg":"Error connecting to mail.giftbutton.com:27017 (146.59.32.248:27017) :: caused by :: SSL peer certificate validation failed: self-signed certificate in certificate chain"}}}

新增节点mail.giftbutton.com日志 #

{"t":{"$date":"2024-12-17T23:47:27.498+00:00"},"s":"I",  "c":"EXECUTOR", "id":22988,   "ctx":"conn2596","msg":"Error receiving request from client. Ending connection from remote","attr":{"error":{"code":141,"codeName":"SSLHandshakeFailed","errmsg":"SSL peer certificate validation failed: self-signed certificate in certificate chain"},"remote":"51.89.216.247:52798","connectionId":2596}}

问题排查方向 #

根据日志中self-signed certificate in certificate chain的错误提示，结合MongoDB副本集X.509认证规则，核心问题出在证书信任链验证环节，具体可能原因：

1. CA证书链不完整：配置的intermRoot.pem仅包含中间CA证书，缺少根CA证书。MongoDB需要完整的信任链来追溯证书来源，缺失根CA会导致peer证书被判定为自签名。
2. 证书文件权限异常：intermRoot.pem、clusterKey.pem等文件的权限或属主设置错误，导致mongod进程无法读取完整的证书内容，进而验证失败。
3. 主机名匹配问题：副本集节点通信时使用IP地址而非主机名，而证书SAN条目仅包含域名，引发验证不匹配（虽然日志中显示用的是主机名，但需确认节点解析是否正确）。

验证与修复步骤 #

• 手动验证证书链：执行openssl verify -CAfile /etc/ssl/openSSL/intermRoot.pem /etc/ssl/openSSL/clusterKey.pem，若提示unable to get local issuer certificate，需将根CA证书追加到intermRoot.pem文件末尾。
• 检查文件权限：确保证书文件权限为600，属主为mongod运行用户（如mongod:mongod），避免进程无读取权限。
• 确认节点通信方式：副本集配置中统一使用主机名而非IP地址，确保与证书SAN条目完全匹配。

内容的提问来源于stack exchange，提问作者jurijus01