MongoDB与Compass无法使用OpenSSL生成的自定义CA证书建立TLS连接

此前用Certbot生成的Let's Encrypt证书临时解决了Compass与VPS上MongoDB的TLS连接问题，涉及两个文件：

• certKey.pem：包含主机证书与私钥
• intermRoot.pem：包含chain.pem和Let's Encrypt根CA证书

但这种方式存在安全隐患：只要知晓MongoDB实例URL，任何人都能为该URL生成自己的Let's Encrypt证书并建立连接——因为MongoDB仅验证CA与证书有效性，不校验客户端证书的具体内容。

为实现真正安全的TLS连接，我改用OpenSSL生成了自定义根CA、中间证书和主机证书，这些证书能通过根CA验证，但MongoDB抛出以下错误：

{"t":{"$date":"2024-12-07T22:13:18.040+00:00"},"s":"E",  "c":"NETWORK",  "id":23256,   "ctx":"conn56","msg":"SSL peer certificate validation failed","attr":{"error":"SSL peer certificate validation failed: unsuitable certificate purpose"}}

恳请提供修复思路。

补充证书内容 #

根CA证书 #

-----BEGIN CERTIFICATE-----
MIIDKzCCAhMCFBCXAonuPQiO/8CyrfFEp6KXMllOMA0GCSqGSIb3DQEBDQUAMFIx
CzAJBgNVBAYTAkFVMREwDwYDVQQIDAhWaWN0b3JpYTESMBAGA1UEBwwJTWVsYm91
cm5lMRwwGgYDVQQDDBNNeSBQZXJzb25hbCBSb290IENBMB4XDTI0MTIwNzE0MzYz
N1oXDTQ0MTIwOTE0MzYzN1owUjELMAkGA1UEBhMCQVUxETAPBgNVBAgMCFZpY3Rv
cmlhMRIwEAYDVQQHDAlNZWxib3VybmUxHDAaBgNVBAMME015IFBlcnNvbmFsIFJv
b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3PDg68NKgWjYk
PejWXSZDcqwOcS+BPdqk63qDAqTGjeKwy/4pmVL7r+NYGhBBy+bsBMopD10adCQt
AIDdvgW6sHdvIaLWvsTx1ciFaOzqHpwIpdXyai5wHdnfVyeWJyU/QOoGh9prfL8Z
BOICzTzTkXbLGf8rKig5QoGxfazFDlryrVcB/6/0iTclS1zXNWsU02nzAs+8ZTaK
vUKrkJxKMzxj7ymjjgDWLFLrK9z1sjcNNPJmrl+bMIY06+U8ds4JUd7s31pgMUTe
PvULjpInwvMPWNCTndPMExu7KCdS8BTil6nIeujr3z1HVVGnUfskAwedE3Ec3EQI
O2sbJ65nAgMBAAEwDQYJKoZIhvcNAQENBQADggEBACnKuXf0mZF2mJ0JCyBTbFd2
4vYjq7OHApfbh2LaTL5ilBdNH5SgdoQhUH2hVURW4qWLrezl3A+WrQM7MTg5pW9s
HtxIvf9vquxN5fYVMjducpk5kp9/ggdowxa7PyG0pFJQTTe2ja1gp1lcCy3uQ0TN
QT9GMi5eVj2KPblbTIHQ1CtcpvbRUbtoLjR+uUxco0Mdsv8kbPZ/YWEkWfssqGB/
6FSIqw18bSgwed50+fy/mF+qFp3zWT0WN/OtacLDzDLkfFicpasEnSUzNe4DcFmr
zu3iiXjfO7RuqH1yaeWEv7xsBJJNyG7T2ZwF4awpD2ivbytNhkjvxsfc6EW7oIo=
-----END CERTIFICATE-----

中间证书 #

-----BEGIN CERTIFICATE-----
MIIDKzCCAhMCFBCXAonuPQiO/8CyrfFEp6KXMllOMA0GCSqGSIb3DQEBDQUAMFIx
CzAJBgNVBAYTAkFVMREwDwYDVQQIDAhWaWN0b3JpYTESMBAGA1UEBwwJTWVsYm91
cm5lMRwwGgYDVQQDDBNNeSBQZXJzb25hbCBSb290IENBMB4XDTI0MTIwNzE0MzYz
N1oXDTQ0MTIwOTE0MzYzN1owUjELMAkGA1UEBhMCQVUxETAPBgNVBAgMCFZpY3Rv
cmlhMRIwEAYDVQQHDAlNZWxib3VybmUxHDAaBgNVBAMME015IFBlcnNvbmFsIFJv
b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3PDg68NKgWjYk
PejWXSZDcqwOcS+BPdqk63qDAqTGjeKwy/4pmVL7r+NYGhBBy+bsBMopD10adCQt
AIDdvgW6sHdvIaLWvsTx1ciFaOzqHpwIpdXyai5wHdnfVyeWJyU/QOoGh9prfL8Z
BOICzTzTkXbLGf8rKig5QoGxfazFDlryrVcB/6/0iTclS1zXNWsU02nzAs+8ZTaK
vUKrkJxKMzxj7ymjjgDWLFLrK9z1sjcNNPJmrl+bMIY06+U8ds4JUd7s31pgMUTe
PvULjpInwvMPWNCTndPMExu7KCdS8BTil6nIeujr3z1HVVGnUfskAwedE3Ec3EQI
O2sbJ65nAgMBAAEwDQYJKoZIhvcNAQENBQADggEBACnKuXf0mZF2mJ0JCyBTbFd2
4vYjq7OHApfbh2LaTL5ilBdNH5SgdoQhUH2hVURW4qWLrezl3A+WrQM7MTg5pW9s
HtxIvf9vquxN5fYVMjducpk5kp9/ggdowxa7PyG0pFJQTTe2ja1gp1lcCy3uQ0TN
QT9GMi5eVj2KPblbTIHQ1CtcpvbRUbtoLjR+uUxco0Mdsv8kbPZ/YWEkWfssqGB/
6FSIqw18bSgwed50+fy/mF+qFp3zWT0WN/OtacLDzDLkfFicpasEnSUzNe4DcFmr
zu3iiXjfO7RuqH1yaeWEv7xsBJJNyG7T2ZwF4awpD2ivbytNhkjvxsfc6EW7oIo=
-----END CERTIFICATE-----

主机证书 #

-----BEGIN CERTIFICATE-----
MIIEijCCA3KgAwIBAgIUejOjYnAVg6oq1thcFJGcS6b72UAwDQYJKoZIhvcNAQEN
BQAwUjELMAkGA1UEBhMCQVUxETAPBgNVBAgMCFZpY3RvcmlhMRIwEAYDVQQHDAlN
ZWxib3VybmUxHDAaBgNVBAMME015IFBlcnNvbmFsIFJvb3QgQ0EwHhcNMjQxMjA3
MTQ0MTE1WhcNMjUwMTIxMTQ0MTE1WjB4MQswCQYDVQQGEwJBVTERMA8GA1UECAwI
VmljdG9yaWExEjAQBgNVBAcMCU1lbGJvdXJuZTETMBEGA1UECgwKTXkgQ29tcGFu
eTEUMBIGA1UECwwLTXkgRGl2aXNpb24xFzAVBgNVBAMMDmdpZnRidXR0b24uY29t
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArnj+uLHifdYMgojGlsNk
w6OKfQhn0xpw+erfCkH2QUt7eOqIEbIk6XuckQbjaSCSzgQ9l90xkqDSe7Ynujcd
j56j/Wx9fv4P4eQufZFBaBaNrCX5mN92mbHw1zQh0bXtBaAFEYFanzbf0P8LovxB
1n1/wuUcFvJMtwDM8YGE0PiQYVT7JBdF/4FQpNtXG9FqY5yapzVlxqDMZZRqWqaR
5lOog5IEUozuETV5t8r/700KBdo4EL3hYzJSQCdhm1o5H01U4dCtlTiZj3lcFrqd
/ts58jPa2MrG6drr3OsPMOsEmk10bnNzRolVYDnHxWSNqkmPSAPRbvhZERwNagq4
uQIDAQABo4IBMDCCASwwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwIwYJ
YIZIAYb4QgENBBYWFE15IEZpcnN0IENlcnRpZmljYXRlMB0GA1UdDgQWBBT6KuPK
w8mShCoapIBBeZv7kMWmxzB3BgNVHSMEcDBuoVakVDBSMQswCQYDVQQGEwJBVTER
MA8GA1UECAwIVmljdG9yaWExEjAQBgNVBAcMCU1lbGJvdXJuZTEcMBoGA1UEAwwT
TXkgUGVyc29uYWwgUm9vdCBDQYIUEJcCie49CI7/wLKt8USnopcyWU4wCwYDVR0P
BAQDAgXgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMC0GA1UdEQQmMCSCDmdpZnRidXR0
b24uY29tghJhcGkuZ2lmdGJ1dHRvbi5jb20wDQYJKoZIhvcNAQENBQADggEBAJlM
5XBqTqgvv9HTdlFCURL7thbRte64O9g/ZUZa7TzibrI/GIp5QcPwlnecE4Ks5DjE
86/oOhDpHOeZDKS9c5ow0w0X5V0I7iBwmnUWSJGlhtkiCawTSymCvRCTqs9B9YzK
Ql1kC6P7+v2FJ4a57eRoX3zIF8v4nC23Z2V0KLd+weQBeS/xe5JKB6KbSpcZDyKL
jWg4NdhO0fJligsS+UnTXYMzbLUc7tJcR20TdmQrwLYKQ85r3NobQcpYDPMmbdP5
DATrwZth+P7jelnrhY0Hq4z6M4j6ijxO38OQBskAX3SiHyTS6yjKJLcbe3iL7d7O
RqMTbhcmy15afny2Qw8=
-----END CERTIFICATE-----

内容的提问来源于stack exchange，提问作者jurijus01