This is a connected to previous question I asked:
[/questions/79256228/compass-and-mongodb-vps-instance-wont-establish-tls-connection/79257323?noredirect=1#comment139765919_79257323][1]
where Wernfried Domscheit provided the solution, which raised further question.
Just like Wernfried Domscheit pointed out, if you know URL of MongoDB instance and you happen to know that LetsEncrypt certs are used for TLS, then nothing is stopping you from generating your own LetsEncrypt certs for this URL and connecting to MongoDB. The established fact is MongoDB only verifying the CA and validity of the cert and isn’t verifying the contents of the cert provided by the client.
The non-obvious solution found that made Compass talk to MongoDB instance on VPS was to use LetsEncrypt certs generated by Certbot. The 2 files are used:
- certKey.pem, which has host certificate and privkey;
- intermRoot.pem, which has chain.pem and rootCA certitifates, wherein the RooCA is downloaded from LetsEncrypt website.
Those are attached to mongodb.conf end. Compass is happy to use certKey only. Connection establishes just fine. Apparently, not happy days, because it’s fake TLS security – like explained above.
The truly secure solution would be make own, custom CA, which nobody can dodge, that MongoDB is actually verifying.
With OpenSSL I generated the custom CA, the host cert and the intermediate cert and they do pass verification against rootCA. But MongoDB isn’t happy:
{"t":{"$date":"2024-12-07T22:13:18.040+00:00"},"s":"E", "c":"NETWORK", "id":23256, "ctx":"conn56","msg":"SSL peer certificate validation failed","attr":{"error":"SSL peer certificate validation failed: unsuitable certificate purpose"}}
Any ideas on how to fix this are appreciated.