0

希望您能够帮助我。我有一个使用 mongodb 2.6.7 的 java 应用程序。现在我必须升级到 4.4.0 版本。在此过程中，我决定实施 TLS 连接，我的问题就从这里开始了。连接超时。

为了简化工作，我决定直接使用 mongo shell 进行连接。现在，情况是这样的：

我在 linux pc 上激活了 mongod 服务器（ubuntu 20.04 - ip: 192.168.1.191，mongodb 安装了 4.4.0，OpenSSL 安装了 1.1.1f），我试图连接 Windows 10 pc（2004 版 - ip: 192.168 .1.193，mongodb 安装 4.4.0，OpenSSL 安装 1.1.1g)。我使用以下命令创建了一个自签名证书：

openssl genrsa -des3 -passout pass:qwer -out ./demoCA/private/cakey.pem 4096

openssl req -new -x509 -days 730 -key ./demoCA/private/cakey.pem -passin pass:qwer -out ./demoCA/cacert.pem -subj '/C=LL/ST=lin/L=lin/O=lin/OU=lin/CN=lin' -outform PEM
cp ./demoCA/cacert.pem ./demoCA/certs/00.pem
cd ./demoCA/certs
ln -s 00.pem `openssl x509 -hash -noout -in 00.pem`.0
cd ..
cd ..
openssl genrsa -out ./private_key.pem 4096
openssl req -new -key ./private_key.pem -out ./request.pem -subj '/C=LL/ST=lin/L=lin/O=lin/OU=lin/CN=192.168.1.191' -outform PEM

openssl ca -in ./request.pem  -passin pass:qwer

cp ./demoCA/newcerts/01.pem ./demoCA/certs/01.pem
cd ./demoCA/certs
ln -s 01.pem `openssl x509 -hash -noout -in 01.pem`.0
cd ..
cd ..
cat ./private_key.pem ./demoCA/certs/01.pem > ./certificate.pem

然后我用这个命令启动了 mongod：

mongod --config /etc/mongod.conf

这里是 mongod.conf：

# Where and how to store data.
storage:
  dbPath: /var/lib/mongodb
  journal:
    enabled: true
#  engine:
#  mmapv1:
#  wiredTiger:

# where to write logging data.
systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log

# network interfaces
net:
  port: 27017
  bindIp: 192.168.1.191
  tls:
    mode: requireTLS
    certificateKeyFile: [ABSOLUTE_PATH]/certificate.pem
    CAFile: [ABSOLUTE_PATH]/demoCA/cacert.pem

# how the process runs
processManagement:
  timeZoneInfo: /usr/share/zoneinfo

#security:
security:
  authorization: "enabled"

我在我的 Win pc certificate.pem 和 cacert.pem 上下载并尝试连接：

mongo --tls --tlsCertificateKeyFile c:\ssl-cert-lin\certificate.pem --tlsCAFile c:\ssl-cert-lin\cacert.pem -u root -p test --authenticationDatabase mydb --host 192.168.1.191 --port 27017

结果：

Error: couldn't connect to server 192.168.1.191:27017, connection attempt failed: SocketException: The client and server cannot communicate, because they do not possess a common algorithm.

经过一千次尝试，我尝试反之亦然，在 windows 上安装 mongodb 服务器并从 linux 连接到 windows。我按照相同的程序创建证书，mongod 的相同配置，使用 mongo 命令的相同连接参数（在 linux 上上传 win 证书之后）。Linux mongo 命令正确连接到 mongod windows 服务器。

因此，我尝试通过 OpenSSL 直接测试连接，以保持 mongo 服务器（在 linux 和 windows 上）都处于活动状态。从 linux (ip:192.168.1.191) 我启动了命令：

root@btksrv:~# openssl s_client -connect 192.168.1.193:27017 -CAfile ./ssl-cert-win/cacert.pem 
CONNECTED(00000003)
Can't use SSL_get_servername
depth=1 C = WW, ST = win, L = win, O = win, OU = win, CN = win
verify return:1
depth=0 C = WW, ST = win, O = win, OU = win, CN = 192.168.1.193
verify return:1
---
Certificate chain
 0 s:C = WW, ST = win, O = win, OU = win, CN = 192.168.1.193
   i:C = WW, ST = win, L = win, O = win, OU = win, CN = win
---
Server certificate
-----BEGIN CERTIFICATE-----
[lines removed...]
-----END CERTIFICATE-----
subject=C = WW, ST = win, O = win, OU = win, CN = 192.168.1.193

issuer=C = WW, ST = win, L = win, O = win, OU = win, CN = win

---
No client certificate CA names sent
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA1:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA1:DSA+SHA1:RSA+SHA512:ECDSA+SHA512
Shared Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:ECDSA+SHA256:ECDSA+SHA384:RSA+SHA512:ECDSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 2248 bytes and written 453 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: B84B0000D21B35AF457FBA576C3C1A4BD42DEC5B1DAC2FA33203DEA6E88DE4E7
    Session-ID-ctx: 
    Master-Key: CA4CEC4DE4AA5B67BC577CCA3DF7D5E5DF5ECEC9438592AAC9D7DDDB105E31FB8CB78DBBE962C0A90D99195ECD86FCBB
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1596710695
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---
read:errno=0

从 windows (ip:192.168.1.193) 我启动了命令：

c:\>openssl s_client -connect 192.168.1.191:27017 -CAfile c:\ssl-cert-lin\cacert.pem
CONNECTED(00000120)
Can't use SSL_get_servername
depth=1 C = LL, ST = lin, L = lin, O = lin, OU = lin, CN = lin
verify return:1
depth=0 C = LL, ST = lin, O = lin, OU = lin, CN = 192.168.1.191
verify return:1
---
Certificate chain
 0 s:C = LL, ST = lin, O = lin, OU = lin, CN = 192.168.1.191
   i:C = LL, ST = lin, L = lin, O = lin, OU = lin, CN = lin
 1 s:C = LL, ST = lin, L = lin, O = lin, OU = lin, CN = lin
   i:C = LL, ST = lin, L = lin, O = lin, OU = lin, CN = lin
---
Server certificate
-----BEGIN CERTIFICATE-----
[lines removed...]
-----END CERTIFICATE-----
subject=C = LL, ST = lin, O = lin, OU = lin, CN = 192.168.1.191

issuer=C = LL, ST = lin, L = lin, O = lin, OU = lin, CN = lin

---
Acceptable client certificate CA names
C = LL, ST = lin, L = lin, O = lin, OU = lin, CN = lin
Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224
Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3832 bytes and written 403 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 0D60B8F6140E7483DDE2D4D3B405E2C81FCC6C18C32B03DA811395A0ED9189A0
    Session-ID-ctx:
    Resumption PSK: 10782266BDE34F8820365AD13FCB606128B410B6D9DBC31D382542E17058975030B4B472A907730AB63573FBD7E900B3
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    [lines removed...]

    Start Time: 1596711179
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: E3A023177260EC48FEF860C30FBF32986E6AA83EA897D5D4E68DD1418329B6C4
    Session-ID-ctx:
    Resumption PSK: BE969CD81BB54EFF67C1F877A29A15C40839767A145252BDD16BDC2E91242E069C8E04D4A3E3DA7D099120D78749EA12
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    [lines removed...]

    Start Time: 1596711179
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
read:errno=0

查看最后 2 个代码块，我认为协议不匹配... Linux 使用 TLS 1.3，Windows 使用 1.2 协议。这可能是问题吗？在这种情况下我该如何解决？否则可能是什么问题？（和解决方案）

在此先感谢您的帮助

Ps 在使用 mongo v4.4 之前我尝试过 v4.2 ......同样的事情

4

1 回答 1

0

找到了解决方案。问题出在 Openssl 中。Linux 预装了 OpenSSL 版本。在 Windows 中，我从这里下载了一个安装程序：https ://slproweb.com/products/Win32OpenSSL.html

问题是第三方编译的 OpenSSL 可能有不同的加密。

我从 Linux 和 Windows 卸载了 OpenSSL，并从https://github.com/openssl/openssl下载了未编译的库。编译后，我重新创建了证书，现在 windows mongo 可以连接 linux mongod，反之亦然

于 2020-08-06T14:54:59.540 回答