本地连接EC2上MongoDB副本集：Compass正常Java客户端报SSL错误

本地机器通过MongoDB Compass可正常连接EC2上部署的MongoDB副本集，但使用依赖Mongo Java客户端的Debezium Mongo源连接器时，出现SSL连接重置错误。

错误信息 #

com.mongodb.MongoSocketWriteException: Exception sending message
    at com.mongodb.internal.connection.InternalStreamConnection.translateWriteException(InternalStreamConnection.java:684)
    at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:555)
    at com.mongodb.internal.connection.InternalStreamConnection.sendCommandMessage(InternalStreamConnection.java:381)
    at com.mongodb.internal.connection.InternalStreamConnection.sendAndReceive(InternalStreamConnection.java:329)
    at com.mongodb.internal.connection.CommandHelper.sendAndReceive(CommandHelper.java:101)
    at com.mongodb.internal.connection.CommandHelper.executeCommand(CommandHelper.java:45)
    at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initializeConnectionDescription(InternalStreamConnectionInitializer.java:131)
    at com.mongodb.internal.connection.InternalStreamConnectionInitializer.startHandshake(InternalStreamConnectionInitializer.java:73)
    at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:182)
    at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.lookupServerDescription(DefaultServerMonitor.java:193)
    at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:157)
    at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: javax.net.ssl.SSLException: Connection reset
    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:127)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:349)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:292)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:287)
    at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:144)
    at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1418)
    at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1324)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
    at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:829)
    at java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:1199)
    at com.mongodb.internal.connection.SocketStream.write(SocketStream.java:99)
    at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:552)
    ... 10 more
    Suppressed: java.net.SocketException: Broken pipe (Write failed)
            at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
            at java.base/java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:110)
            at java.base/java.net.SocketOutputStream.write(SocketOutputStream.java:150)
            at java.base/sun.security.ssl.SSLSocketOutputRecord.encodeAlert(SSLSocketOutputRecord.java:81)
            at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:380)
            ... 20 more
Caused by: java.net.SocketException: Connection reset
    at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186)
    at java.base/java.net.SocketInputStream.read(SocketInputStream.java:140)
    at java.base/sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:478)
    at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:472)
    at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:160)
    at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:110)
    ... 17 more

已做检查 #

• 服务器支持的TLS版本：

  openssl ciphers -v | awk '{print $2}' | sort | uniq
  # 输出：
  SSLv3
  TLSv1
  TLSv1.2
  TLSv1.3
  

• 本地客户端支持的TLS版本：

  openssl ciphers -v | awk '{print $2}' | sort | uniq
  # 输出：
  SSLv3
  TLSv1.2
  TLSv1.3
  

解决方案 #

1. 强制Mongo Java客户端使用兼容的TLS协议 #

在Debezium连接器配置中添加以下参数，指定仅使用双方都支持的TLS版本：

mongodb.ssl.enabledProtocols=TLSv1.2,TLSv1.3

如果连接器运行在JVM环境中，也可以通过JVM参数强制启用对应TLS版本：

-Djdk.tls.client.protocols=TLSv1.2,TLSv1.3

2. 验证MongoDB副本集的SSL配置 #

检查MongoDB配置文件中的net.ssl.enabledProtocols设置，确保它包含TLSv1.2和TLSv1.3（避免仅启用旧版本协议导致协商失败）。同时确认MongoDB的证书是否有效，若使用自签名证书，需确保Java客户端的信任库已导入对应的CA证书。

3. 检查Java版本的TLS默认策略 #

不同Java版本的默认TLS支持策略不同，比如Java 8u291及以后版本默认禁用TLSv1等旧协议。确认Debezium使用的Java版本，确保其默认启用的TLS版本与服务器端兼容。

4. 排除网络层面的干扰 #

虽然Compass能连接，但仍需确认Debezium运行环境的网络是否允许访问MongoDB的端口（默认27017），EC2安全组是否放行Debezium所在IP的流量，避免因防火墙或安全组规则导致连接重置。

内容的提问来源于stack exchange，提问作者Ritik