Self signed certificate issue in certificate chain in MongoDB cluster

shyama_lakshmi · 2024-08-16T16:25:24.238Z

Free cluster account created through aws and accessing that account through locally installed compass

Jack_Woehr · 2024-08-16T16:29:04.243Z

You may have to talk to AWS support or read more documentation about setting up a VPN. The error isn’t MongoDB, it’s something in your environment.

shyama_lakshmi · 2024-08-16T16:32:47.580Z

Yah, its Windows virtual Desktop, from that environment getting issue. When local system connected to Global VPN also same problem arises

Jack_Woehr · 2024-08-16T18:40:34.329Z

But you say there is no certificate installed with your MongoDB installation, self-signed or otherwise?

shyama_lakshmi · 2024-08-20T05:24:26.051Z

yah no certificate I installed during the creation of mongodb cluster

shyama_lakshmi · 2024-08-20T16:54:29.890Z

no certificate we are used while creating cluster account. And if we tried with allow access anywhere for testing purpose, at that time also WVD not connecting

Jack_Woehr · 2024-08-20T17:16:05.040Z

Sounds like your VPN is problematic.

shyama_lakshmi · 2024-08-21T07:50:47.297Z

can you please suggest any solution we need to look around. That will help the network team to look on. What about your suggestions to overcome this issue?

Jack_Woehr · 2024-08-21T19:41:16.324Z

Read the MongoDB FAQ: Security and make sure your VPN and operating system accept the Let’s Encrypt’s root Certificate Authority (ISRG Root X1)

shyama_lakshmi · 2024-08-22T07:28:14.911Z

Thank you for the update, Jack. I have a concern: can we directly use the ISRG ROOT X1 certificate, or do we need to generate a self-signed certificate for WVD? Will it solve our problem? We are currently stuck in our project. Could you provide a certificate for WVD testing purposes?

Jack_Woehr · 2024-08-22T14:37:47.708Z

If I correctly understand your problem, @shyama_lakshmi , some part of your setup is not accepting MongoDB’s Let’s Encrypt certificate. I do not know where it is not being accepted … in your VPN security software? In WVD? I cannot tell from your description.

You should try first downloading the ISRC Root and install it in WVD and see if that works.

shyama_lakshmi · 2024-08-22T15:27:29.628Z

I tried with the mentioned certificate, downloaded and saved as .pem file. I am trying to connect my cluster from WVD platform and uploaded the .pem file via compass, same certificate issue message is showing. FYI: Attached Screenshot

selfSigned726×569 20.5 KB

Jack_Woehr · 2024-08-22T16:16:24.980Z

If we diagnosed the problem correctly, what you did there should fix it.
It did not fix it!

Let me make sure once again that I understand what is happening:

Compass → Atlas No VPN … TLS is enabled, TLS works
Compass → Atlas Yes VPN … TLS is enabled TLS does not work, even with tlsCAFile assigned.

IF I have stated this correctly THEN I suggest one more test, if you can do it:

Try a connection on your VPN using real Linux or MocOS instead of WVD.
- If this works, the problem is WVD
- If this does not work, the problem is the VPN itself

shyama_lakshmi · 2024-08-22T16:33:27.426Z

Thank you jack for your reply. Will try and update you.

shyama_lakshmi · 2024-08-22T16:37:16.167Z

I just downloaded the ISRG certificate and saved as .pem file. I didn’t install that certificate in my WVD. Is that the problem. I am really new to this certificate related area that’s why. Really thanks for your time and reply

Jack_Woehr · 2024-08-22T16:40:19.289Z

I thought it would be sufficient to do what you did: to assign it as the tlsCAFile in the Compass URI for your Atlas instance.
However, you can also try inserting the .pem in the certificate authority store for the WVD instance.
I know how that works on real Linux, but I don’t know how it works on WVD.
You should try that, because if you do not try that, we’ll never convince your network administrator that the network is the problem

shyama_lakshmi · 2024-08-23T07:12:15.775Z

I added .pem file to certificate folder, now the list showing the ISRG X1 certificate. After that I tried to connect by checking Use System Certificate Authority , showing error message as ‘read ECONNRESET’

Jack_Woehr · 2024-08-23T14:20:34.683Z

Try adding the actual site certificate as well. I don’t think it will help, but try it just to complete your analysis.

shyama_lakshmi · 2024-08-28T14:44:15.630Z

From our testing, we found that we can easily connect to the Azure MongoDB cluster database from our Windows Virtual Desktop (WVD). However, we are unable to connect to our AWS MongoDB cluster database from WVD, even though we are using the correct certificate. Could you please look into this? I believe this information might help you understand that the issue could be related to the differences between the Azure and AWS MongoDB platforms.

FYI, I am attaching the error log I received when attempting to connect to the AWS cluster.

ERROR: The driver was unable establish a valid connection to any server in the MongoDB deployment, so cannot perform a server selection. Detail: Server selection timeout: No available servers. Topology: { Type: ReplicaSetNoPrimary, Servers: [ { Address: cluster0-shard-00-01.3pz6r.mongodb.net:27017, Type: Unknown }, { Address: cluster0-shard-00-02.3pz6r.mongodb.net:27017, Type: Unknown }, { Address: cluster0-shard-00-00.3pz6r.mongodb.net:27017, Type: Unknown }, ] }

UNDERLYING ERROR: Server selection timeout: No available servers. Topology: { Type: ReplicaSetNoPrimary, Servers: [ { Address: cluster0-shard-00-01.3pz6r.mongodb.net:27017, Type: Unknown }, { Address: cluster0-shard-00-02.3pz6r.mongodb.net:27017, Type: Unknown }, { Address: cluster0-shard-00-00.3pz6r.mongodb.net:27017, Type: Unknown }, ] }

Jack_Woehr · 2024-08-28T15:24:31.182Z

shyama_lakshmi:

From our testing, we found that we can easily connect to the Azure MongoDB cluster database from our Windows Virtual Desktop (WVD). However, we are unable to connect to our AWS MongoDB cluster database from WVD, even though we are using the correct certificate.

It sounds like you need support from AWS.