Spring Boot连接Atlas MongoDB遇SSL握手异常求助

我尝试用以下配置从Spring Boot连接Atlas MongoDB实例：

spring.data.mongodb.uri=mongodb+srv://<usr>:<pass>@<my-cluster-prefix>.gkyoqkx.mongodb.net/?retryWrites=true&w=majority
spring.data.mongodb.database=my-db

该连接串是从Atlas的「Connect」->「Connect your application」获取的，本应有效，但启动应用时出现如下异常：

2022-08-22 17:13:42.836  INFO 52641 --- [ngodb.net:27017] org.mongodb.driver.cluster               : Exception in monitor thread while connecting to server ac-opxd8w6-shard-00-02.gkyoqkx.mongodb.net:27017

com.mongodb.MongoSocketWriteException: Exception sending message
    at com.mongodb.internal.connection.InternalStreamConnection.translateWriteException(InternalStreamConnection.java:684) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:555) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.InternalStreamConnection.sendCommandMessage(InternalStreamConnection.java:381) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.InternalStreamConnection.sendAndReceive(InternalStreamConnection.java:329) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.CommandHelper.sendAndReceive(CommandHelper.java:101) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.CommandHelper.executeCommand(CommandHelper.java:45) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initializeConnectionDescription(InternalStreamConnectionInitializer.java:131) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.InternalStreamConnectionInitializer.startHandshake(InternalStreamConnectionInitializer.java:73) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:182) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.lookupServerDescription(DefaultServerMonitor.java:193) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:157) ~[mongodb-driver-core-4.6.1.jar:na]
    at java.lang.Thread.run(Thread.java:745) [na:1.8.0_60]
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names matching IP address 34.95.185.60 found
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.8.0_60]
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949) ~[na:1.8.0_60]
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) ~[na:1.8.0_60]
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) ~[na:1.8.0_60]
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1506) ~[na:1.8.0_60]
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[na:1.8.0_60]
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) ~[na:1.8.0_60]
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:914) ~[na:1.8.0_60]
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) ~[na:1.8.0_60]
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) ~[na:1.8.0_60]
    at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747) ~[na:1.8.0_60]
    at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) ~[na:1.8.0_60]
    at com.mongodb.internal.connection.SocketStream.write(SocketStream.java:99) ~[mongodb-driver-core-4.6.1.jar:na]
    at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:552) ~[mongodb-driver-core-4.6.1.jar:na]
    ... 10 common frames omitted

我感到困惑的是，默认情况下应该不会使用SSL连接（据我所知）。我已在Atlas的网络访问中添加0.0.0.0/0白名单所有IP，且使用Mac上的mongosh和相同连接串可以完美连接。

环境信息：

• Atlas MongoDB版本：5.0.10
• Mongo驱动版本：4.6.1

解决建议 #

1. 明确指定SSL连接参数 #

Atlas MongoDB默认强制要求SSL连接，mongodb+srv格式的连接串会自动启用SSL，但旧版JDK可能在证书验证时存在解析问题。可以在连接串中显式添加SSL相关参数：

spring.data.mongodb.uri=mongodb+srv://<usr>:<pass>@<my-cluster-prefix>.gkyoqkx.mongodb.net/my-db?retryWrites=true&w=majority&ssl=true&sslInvalidHostNameAllowed=false

如果是临时测试，可开启sslInvalidHostNameAllowed=true跳过主机名验证，但生产环境严禁使用该参数。

2. 升级JDK版本 #

你使用的JDK 1.8.0_60版本过旧，对SNI（Server Name Indication）的支持不完善，而Atlas的证书依赖SNI实现主机名匹配。升级到JDK 8u251及以上版本，或直接切换到JDK 11/17，可解决证书验证时IP与主机名不匹配的问题。

3. 检查DNS解析问题 #

异常中的IP34.95.185.60对应的主机名可能未正确解析，导致JVM用IP去匹配证书的主题备用名称。在本地执行nslookup ac-opxd8w6-shard-00-02.gkyoqkx.mongodb.net，确认解析出的主机名与证书中的一致；若存在DNS缓存问题，尝试清除本地DNS缓存后再测试。

4. 确认MongoDB驱动配置 #

检查Spring Boot是否存在其他配置覆盖了SSL设置，比如代码中手动配置MongoClient时禁用了SSL。确保所有配置统一使用连接串中的SSL参数，避免配置冲突。

内容的提问来源于stack exchange，提问作者Vit Ias