Mongoose not sending SSL cert to MongoDB server

Question

I'm having issues with using some self-signed SSL certificates with Mongoose. The thing that's getting me hung up is that I can connect to the database server just fine with the normal Mongo Node client, but when I try the connection using the exact same configuration with Mongoose.createConnection, I get an error message reading '[conn1] no SSL certificate provided by peer' when I check the Mongod logs.

This is the code I use to connect with the MongoClient.connect (works):

var MongoClient = require('mongodb').MongoClient
var fs = require('fs')  

// Read the certificates
const ca = [fs.readFileSync(process.env.caPath)];
const cert = fs.readFileSync(process.env.certPath);
let urlPath = ["mongodb://", username, ":", password, "@", dburl, ":", port, "/collection?&ssl=true"]
let url = urlPath.join('')

// Connect validating the returned certificates from the server
const options = {
  server: {
    ssl: true,
    sslValidate: true,
    sslCA: ca,
    sslCert: cert
  }
}

MongoClient.connect(url, options, function(err, db) {
  do stuff
})

And this is the code using Mongoose.createConnection (doesn't work):

const mongoose = require('mongoose');
const fs = require('fs')

let urlPath = ["mongodb://", username, ":", password "@", dburl, ":", port, "/collection?&ssl=true"]
let url = urlPath.join('')

var ca = [fs.readFileSync(process.env.caPath, 'utf8')];
var cert = fs.readFileSync(process.env.certPath, 'utf8');

const options = {
  server: {
    ssl: true,
    sslValidate: true,
    sslCA: ca,
    sslCert: cert
  }
}
const connection = mongoose.createConnection(url, options)

According to the Mongoose docs , this looks like the right way to connect, and to add to the weirdness, passing in the server options to Mongoose.connect seems to work as well.

Thank you!

Answer 1

I had the same problem, but I found that it was because I have cat 'ed the key and certificate together in the same .pem file (as suggested in the mongodb docs).

But it's easily fixed, just specify the same file under both sslCert: and sslKey: like this:

const options = {
    server: {
        ssl: true,
        sslValidate: true,
        sslCA: ca,
        sslCert: cert,
        sslKey: cert
    }
}

In my case, it wasn't necessary to specify neither authMechanism nor authSource .

Answer 2

You need to set some additional authentication options ( authMechanism and authSource ) on mongoose.connect() to specify the SSL cert. See: https://docs.mongodb.com/manual/reference/connection-string/#authentication-options

These can be specified as options to mongoose like this: options.auth = { authMechanism: 'MONGODB-X509', authSource: '$external' }

then connect with those options:

this.mongoose.connect(uri, options, (err) => { ...