Error connecting to atlas ssl - TLS handshake failed: Failed certificate verification calling hello

Lovro_Toplomyer · 2024-07-10T11:31:09.673Z

Hello world! I’m getting kinda desperate here as I have tried a lot of things and none of it works.

Since the upgrade to php 8 and upgrading php mongo lib to 1.19.1 from 1.4.2 I’m unable to connect to Atlas when ssl is enabled and when options:

tlsAllowInvalidCertificates
tlsAllowInvalidHostnames

are disabled. When they are enable I can connect to atlas and everything works. In the Atlas logs it seem that it receives an connection and then client immediately disconnects.

The error I constantly get is:

No suitable servers found (serverSelectionTryOnce set): [TLS handshake failed: Failed certificate verification calling hello on 'xxx.mongodb.net:27017'] [TLS handshake failed: Failed certificate verification calling hello on 'xxx.mongodb.net:27017'] [TLS handshake failed: Failed certificate verification calling hello on 'xxx.mongodb.net:27017']

I"m using docker alpine3.19 and php 8.3.7 ran on AWS linux2.

I have tried everything that came to my mind (and that has any reference on google) from checking if ssl is installed properly, downloading certificates and putting them to the ssl configs and providing cert file. My network config in the Atlas UI allows connecting from my IP ranges, downgrading PHP lib version, changing connection strings and trying out different options but none of it works.
My config on atlas does not require ca files and it used to work like that up until the big upgrade.

Does someone have any idea what can cause this error and possibly how to solve it?

Rishabh_Bisht · 2024-07-12T10:26:03.720Z

This seems to be a case of SSL certificates not accessible / incorrect.
It maybe the case that your PHP environment doesn’t have the correct location for certificates. Could you run below command from your PHP environment and cross check the certificates location?

php.net

PHP: openssl_get_cert_locations - Manual

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

Lovro_Toplomyer · 2024-07-15T10:30:13.852Z

Ok I got it, i had to specify ca file path for the connection string, now when I have done that i get the similar error just a little bit less expressive:

failed certificate just became connection error

No suitable servers found (serverSelectionTryOnce set): [connection error calling hello on 'xxx.yyy.mongodb.net:27017'] [connection error calling hello on 'xxx.yyy.mongodb.net:27017'] [connection error calling hello on 'xxx.yyy.mongodb.net:27017']

At least we know it resolves the names in the cluster and certificate must be fine now but I’m not really sure how to debug this connection error string

Lovro_Toplomyer · 2024-07-15T10:30:17.197Z

array(8) {
  ["default_cert_file"]=>
  string(17) "/etc/ssl/cert.pem"
  ["default_cert_file_env"]=>
  string(13) "SSL_CERT_FILE"
  ["default_cert_dir"]=>
  string(14) "/etc/ssl/certs"
  ["default_cert_dir_env"]=>
  string(12) "SSL_CERT_DIR"
  ["default_private_dir"]=>
  string(16) "/etc/ssl/private"
  ["default_default_cert_area"]=>
  string(8) "/etc/ssl"
  ["ini_cafile"]=>
  string(0) ""
  ["ini_capath"]=>
  string(0) ""
}

php -i | grep openssl
Configure Command =>  './configure'  '--build=x86_64-linux-musl' '--with-config-file-path=/usr/local/etc/php' '--with-config-file-scan-dir=/usr/local/etc/php/conf.d' '--enable-option-checking=fatal' '--with-mhash' '--with-pic' '--enable-mbstring' '--enable-mysqlnd' '--with-password-argon2' '--with-sodium=shared' '--with-pdo-sqlite=/usr' '--with-sqlite3=/usr' '--with-curl' '--with-iconv=/usr' '--with-openssl' '--with-readline' '--with-zlib' '--disable-phpdbg' '--with-pear' '--disable-cgi' '--enable-fpm' '--with-fpm-user=www-data' '--with-fpm-group=www-data' 'build_alias=x86_64-linux-musl'
openssl
Openssl default config => /etc/ssl/openssl.cnf
openssl.cafile => no value => no value
openssl.capath => no value => no value

And when running this command:

openssl s_client -showcerts -connect  xxx.xxx.mongodb.net:27017 < /dev/null

There are no ssl errors which indicates that the problem might be somewhere in the PHP driver.

When running very minimal PHP script to reproduce it i get the ssl error every time but when doing the same with very minimal Node.js app it goes perfectly. So there must be something about php lib

Rishabh_Bisht · 2024-07-17T07:39:51.711Z

Can you please check if you are able to connect to the cluster via mongosh from the docker instance?

Lovro_Toplomyer · 2024-07-17T17:05:20.025Z

Actuality I managed to solve it.

The issue was in the libressl that my docker build was using, I replaced it with the openSSL and all of the sudden it started working like a charm. I guess mongo driver for php had some issues with compiling ssl layer or something related libressl.

Thank you for your help.

Rishabh_Bisht · 2024-07-18T10:27:37.714Z

Glad to hear @Lovro_Toplomyer
Do you remember the version of Libressl that was present?

Joel_Moran · 2024-08-19T11:14:20.340Z

Heloo everybody. I am a newbie in coding. We started using mongoDb together with MongoDb Compass and it was working until last week.
Now if I try to connect, I get the following message:

1357226088960:error:10000438:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR:…/…/third_party/boringssl/src/ssl/tls_record.cc:592:SSL alert number 80

I have abosolutely no idea what that means and how to deal with the issue. A while searching, this thread is what I found that I thought could be similar to what I am facing.

However, I have to admit that I could not understand how it was resolved at all.

Could somebody please help me resolve my issue? Thanks and have a nice day!

alexbevi · 2024-08-19T12:32:04.610Z

Joel_Moran:

SSL alert number 80

The user at TLS handshake (alert number 80) issue between AWS ECS instance and Atlas had a similar issue, though I’m not sure if the solution addresses your use case.

Are you saying MongoDB Compass stopped working, or your application stopped working?

Joel_Moran · 2024-08-22T10:43:01.163Z

Hi Alex, Jhoney, sorry for the late reply. It seems like the email app on my mac also is having some issues. I just noticed it this morning.

Anyway, I was also already able to solve my mongoDB compass issue with the help of a friend. Apparently, my ISP changes my IP address regularly causing the failed connection.

Going to the “Network Access” under “Data Services” in cloud.mongodb and then clicking on the link “Add Current IP Address” took care of my issue.

Just the same, thanks a lot for your time and looking at my issue.

Have a nice day, everybody!