Spring boot connecting to mongodb with ssl (peer certificate validation failed)

Question

I'm not able to connect my spring-boot-app(v1.5.7) to my mongodb-server(localhost with ssl (Win7_x64); v.3.4.6; self-signed; login without ssl is working).

RoboT3 is connecting without problems to my mongodb.

I've followed several solutions, this is the last one I've tried without success:

Added this to my Main-Class:

    @Bean
    public MongoClientOptions mongoClientOptions() {
        System.setProperty("javax.net.ssl.trustStore","ssl/keystore/mongoStore.ts");
        System.setProperty("javax.net.ssl.trustStorePassword","123456");
        System.setProperty ("javax.net.ssl.keyStore","ssl/keystore/mongoClientKeyCert.jks");
        System.setProperty ("javax.net.ssl.keyStorePassword","123456");
        MongoClientOptions.Builder builder = MongoClientOptions.builder();
        MongoClientOptions options = builder.sslEnabled(true).sslInvalidHostNameAllowed(true).build();        
        return options;
    }

I created the trustStore and the keyStore following this article.

The crt, pem and key for ca, client and server is created accordingly to this question.

Exception thrown:

com.mongodb.MongoSocketReadException: Exception receiving message
    at com.mongodb.connection.InternalStreamConnection.translateReadException(InternalStreamConnection.java:483)
    at com.mongodb.connection.InternalStreamConnection.receiveMessage(InternalStreamConnection.java:228)
    at com.mongodb.connection.CommandHelper.receiveReply(CommandHelper.java:134)
    at com.mongodb.connection.CommandHelper.receiveCommandResult(CommandHelper.java:121)
    at com.mongodb.connection.CommandHelper.executeCommand(CommandHelper.java:32)
    at com.mongodb.connection.InternalStreamConnectionInitializer.initializeConnectionDescription(InternalStreamConnectionInitializer.java:85)
    at com.mongodb.connection.InternalStreamConnectionInitializer.initialize(InternalStreamConnectionInitializer.java:45)
    at com.mongodb.connection.InternalStreamConnection.open(InternalStreamConnection.java:116)
    at com.mongodb.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:113)
    at java.lang.Thread.run(Unknown Source)
Caused by: java.net.SocketException: Software caused connection abort: recv failed
    at java.net.SocketInputStream.socketRead0(Native Method)
    at java.net.SocketInputStream.read(Unknown Source)
    at java.net.SocketInputStream.read(Unknown Source)
    at sun.security.ssl.InputRecord.readFully(Unknown Source)
    at sun.security.ssl.InputRecord.read(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown Source)
    at sun.security.ssl.AppInputStream.read(Unknown Source)
    at com.mongodb.connection.SocketStream.read(SocketStream.java:85)
    at com.mongodb.connection.InternalStreamConnection.receiveResponseBuffers(InternalStreamConnection.java:494)
    at com.mongodb.connection.InternalStreamConnection.receiveMessage(InternalStreamConnection.java:224)
    ... 8 common frames omitted

Error Message of MongoDB(Console):

SSL peer certificate validation failed: self signed certificate

MongoDB start-command:

.\mongod.exe --dbpath .\db --auth -sslMode requireSSL --sslAllowConnectionsWithoutCertificates --sslPEMKeyFile .\ssl\server\server.pem --sslCAFile .\ssl\ca\ca.pem

What can I do to make it work?

marionmaiden marionmaiden · Accepted Answer · 2020-07-06T11:40:43

We had a similar problem and that's what we did:

Registered with keytool the trust CA certtificate: ./path_to_your_crt.crt
Used openssl to convert the client certificate .pem (./path_to_your_pem.pem) file to pkcs12 (./output_key_path.pkcs12)
Registered with keytool the client certificate: (./output_key_path.pkcs12)

keytool -import -alias clusterkey -file ./path_to_your_crt.crt -keystore mongostore -storetype pkcs12 -storepass your_password  -noprompt
openssl pkcs12 -passout pass:your_password -export -out ./output_key_path.pkcs12 -in ./path_to_your_pem.pem
keytool -importkeystore -srckeystore ./output_key_path.pkcs12 -srcstoretype PKCS12 -destkeystore mongoclient -deststoretype pkcs12 -srcstorepass your_password -deststorepass your_password -noprompt

Internally I configured the bean just like yours

Spring boot connecting to mongodb with ssl (peer certificate validation failed)

1 Answers