MongoDB C＃SSL客戶端證書

Question

我正在嘗試使用證書驗證與C＃驅動程序建立與MongoDB的安全連接，但我收到此錯誤：

無法連接到服務器localhost：27017：無法從傳輸連接讀取數據：已建立的連接已被主機中的軟件中止。

下面是MongoDB的錯誤：

[initandlisten] connection accepted from 127.0.0.1:26163 #2 (1 connection now open)
[conn2] ERROR: no SSL certificate provided by peer; connection rejected
[conn2] SocketException handling request, closing client connection: 9001 socket exception [CONNECT_ERROR]

當我通過mongo shell連接MongoDB並使用證書時它可以工作。

var connectionString = "mongodb://localhost";
var clientSettings = MongoClientSettings.FromUrl(new MongoUrl(connectionString));
clientSettings.SslSettings = new SslSettings();
clientSettings.UseSsl = true;
clientSettings.SslSettings.ClientCertificates = new List<X509Certificate>()
    {
        new X509Certificate("cert.pem")
    };
clientSettings.SslSettings.EnabledSslProtocols = SslProtocols.Default;
clientSettings.SslSettings.ClientCertificateSelectionCallback =
    (sender, host, certificates, certificate, issuers) => clientSettings.SslSettings.ClientCertificates.ToList()[0];
clientSettings.SslSettings.ServerCertificateValidationCallback = (sender, certificate, chain, errors) => true;
var client = new MongoClient(clientSettings);

有誰知道如何使這個工作？

Answer 1

意識到這已經過時但是為了別人的利益......

如果您未處理證書吊銷列表，則需要關閉該設置，因為默認情況下已啟用該設置。

clientSettings.SslSettings.CheckCertificateRevocation = false;

接下來，您提供給驅動程序的X509Certificate2必須包含私鑰。 .NET似乎沒有在pem文件中獲取私鑰，因此您需要提供.pfx格式的證書並包含密碼。

要在openssl中創建一個pfx文件：

openssl pkcs12 -export -in mycert.cer -inkey mycert.key -out mycert.pfx

OpenSSL將提示您輸出密碼，在創建X509Certificate2對象時使用它：

X509Certificate2 cert = new X509Certificate2("mycert.pfx","mypassphrase");

Answer 2

 //struggled a lot to figure out this using MongoDB.Bson; using MongoDB.Driver; namespace Mongo_AWS { internal class Program { private static void Main(string[] args) { //Mention cert file in connection string itself or put at your executable location string connectionString = @"mongodb://user:pwd@localhost:9999/?ssl=true&ssl_ca_certs=C:\\Users\\sivaram\\Downloads\\my.pem"; MongoClientSettings settings = MongoClientSettings.FromUrl(new MongoUrl(connectionString)); //Disable certificate verification, if it is not issued for you settings.VerifySslCertificate = false; MongoClient client = new MongoClient(settings); IMongoDatabase database = client.GetDatabase("test"); IMongoCollection<BsonDocument> collection = database.GetCollection<BsonDocument>("numbers"); System.Collections.Generic.List<BsonDocument> temp = collection.Find(new BsonDocument()).ToList(); BsonDocument docToInsert = new BsonDocument { { "sivaram-Pi", 3.14159 } }; collection.InsertOne(docToInsert); } } } 

Answer 3

，ssl_ca_certs = @“/ path / my.pem”，在連接字符串中添加了這個。

settings.VerifySslCertificate = false;

如果您從本地測試它/你有根證書但沒有發給你的機器，可以使用上面的行，可能會發給你的生產主機。

將根證書放在絕對路徑中，並直接在連接字符串中引用該路徑。 Mongo司機將負責閱讀私鑰和所有。 無需將其放在證書庫或某處。