I'm seeing this error message whenever I attempt to connect with SSL flags --ssl, --sslAllowInvalidHostnames, and --sslCAFile:
MongoDB shell version v4.0.10
connecting to: mongodb://<redacted>
2019-07-01T14:47:17.420-0700 D NETWORK [js] creating new connection to:<redacted>
2019-07-01T14:47:17.687-0700 E NETWORK [js] SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected
2019-07-01T14:47:17.687-0700 D - [js] User Assertion: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected src/mongo/transport/session_asio.h 242
2019-07-01T14:47:17.687-0700 D - [js] User Assertion: InternalError: couldn't connect to server <redacted>, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected src/mongo/scripting/mozjs/mongo.cpp 757
2019-07-01T14:47:17.687-0700 E QUERY [js] Error: couldn't connect to server <redacted>, connection attempt failed: SSLHandshakeFailed: SSL peer certificate validation failed: Certificate trust failure: CSSMERR_TP_VERIFY_ACTION_FAILED; connection rejected :
connect@src/mongo/shell/mongo.js:344:17
@(connect):2:6
2019-07-01T14:47:17.687-0700 D - [js] User Assertion: Location12513: connect failed src/mongo/shell/shell_utils.cpp 344
2019-07-01T14:47:17.687-0700 I QUERY [js] MozJS GC prologue heap stats - total: 3664180 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY [js] MozJS GC epilogue heap stats - total: 2620 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY [js] MozJS GC prologue heap stats - total: 4916 limit: 0
2019-07-01T14:47:17.689-0700 I QUERY [js] MozJS GC epilogue heap stats - total: 12 limit: 0
2019-07-01T14:47:17.690-0700 D - [main] User Assertion: Location12513: connect failed src/mongo/scripting/mozjs/proxyscope.cpp 302
exception: connect failed
I have verified the following:
- My SSL cert is up-to-date and confirmed to be correct
- My SSL version is 1.0.2s
- My mongo version is updated to v4.0.10
- I'm using MacOS X 10.14.5
This seems to be a very Apple related issue as the only reference about the failure message was listed in https://developer.apple.com/documentation/security/1396762-cmsdecodercopysignerstatus?language=objc
What else can I check to fix this issue on CSSMERR_TP_VERIFY_ACTION_FAILED?
Expected to connect to the database with SSL cert.