使用含tlsAllowInvalidCertificates参数的URI连接MongoDB失败求助

Let’s walk through fixing this connection issue step by step—your current URI isn’t bypassing certificate validation as expected, and we’ll get to the root of why.

Core Issue Breakdown #

The error SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_NOT_TRUSTED tells us your MongoDB client is still trying to validate the server’s certificate against its trusted CA store, even though you added tlsAllowInvalidCertificates=true to your connection string. The most likely culprit is a malformed URI combined with how MongoDB parses parameters.

Step 1: Fix the Connection String’s Parameter Separators #

Look closely at your current URI:

mongo 'mongodb://mongoadmin:mxmxmxmxm@server:27017/?tls=true&tlsInvalidHostNameAllowed=true&tlsAllowInvalidCertificates=true&authMechanism=SCRAM-SHA-1'

You’re using & (HTML-escaped ampersands) instead of plain & to separate parameters. The MongoDB shell doesn’t recognize & as a parameter delimiter—so only the first parameter (tls=true) is being applied, and the rest (tlsInvalidHostNameAllowed, tlsAllowInvalidCertificates) are being completely ignored.

Fix the URI by replacing all & with &:

mongo 'mongodb://mongoadmin:mxmxmxmxm@server:27017/?tls=true&tlsInvalidHostNameAllowed=true&tlsAllowInvalidCertificates=true&authMechanism=SCRAM-SHA-1'

Step 2: Check Client Version for Parameter Prefix Compatibility #

If you’re using a MongoDB client older than version 4.0, note that TLS-related parameters used the ssl prefix instead of tls. For example:

mongo 'mongodb://mongoadmin:mxmxmxmxm@server:27017/?ssl=true&sslInvalidHostNameAllowed=true&sslAllowInvalidCertificates=true&authMechanism=SCRAM-SHA-1'

Verify your client version with mongo --version to confirm which prefix to use.

Step 3: Secure Alternative – Trust the Server’s CA (Recommended) #

Disabling certificate validation is insecure for production environments. Instead, configure your client to trust the CA certificate your server uses (/etc/ssl/certs/ca.f5.bci.cl.cer):

1. Copy this CA file from the server to your client machine.
2. Use the --sslCAFile parameter to establish a trusted connection:

mongo --ssl --sslCAFile /path/to/copied/ca.f5.bci.cl.cer --host server --port 27017 -u mongoadmin -p mxmxmxmxm --authenticationDatabase admin

Step 4: Double-Check Server Configuration #

From your provided server config, confirm these settings are correct:

• ssl.mode: requireSSL is properly enforcing TLS connections
• CAFile: /etc/ssl/certs/ca.f5.bci.cl.cer points to a valid, unexpired CA certificate
• allowConnectionsWithoutCertificates: true is enabled (which it is), so clients don’t need to present their own certificates

If you’ve fixed the URI and still see errors, verify the CA certificate on the server matches the one on your client (use file hashes to check for corruption).

内容的提问来源于stack exchange，提问作者Rodrigo Saur Caces