search

percona / mongodb_exporter

A Prometheus exporter for MongoDB including sharding, replication and storage engines
Apache License 2.0
1.18k stars 423 forks source link

TLS not working correctly: tlsCertificateKeyFile not sending intermediate(s) #335

Closed whiemstra closed 4 months ago

whiemstra commented 3 years ago

In the 0.10.x, 0.11.x and 0.20.x versions using TLS works not as expected. Since version 0.10.x the --mongodb.tls-cert was replaced with the connection string option tlsCertificateKeyFile. When using a public and private certificate and also a chain of intermediates (all in the same pem file) the chain of intermediates is not send to the MongoDB instance and the connection will fail, which did not fail with --mongodb.tls-cert was available.

In version 0.11.2 the logging shows: INFO[0000] Starting mongodb_exporter (version=, branch=, revision=) source="mongodb_exporter.go:81" INFO[0000] Build context (go=go1.15.2, user=, date=19700101-01:00:00) source="mongodb_exporter.go:82" ERRO[0000] Can't create mongo session to mongodb://**** source="mongodb_collector.go:188" INFO[0000] Starting HTTP server for http://:9216/metrics ... source="server.go:140"

Metrics page does not show an error.

In version 0.20.7 the logging shows: INFO[0000] Starting HTTP server for http://:9216/metrics ... source="server.go:140" ERRO[0009] Cannot connect to MongoDB: tls: private key does not match public key

Metrics page shows error: An error has occurred while connecting to MongoDB: tls: private key does not match public key

In the older version 0.9.x it was possible to set --mongodb.tls-cert which works as expected. The intermediates are also send to the MongoDB instance.

mukerjee commented 2 years ago

I ran into this issue as well. It appears to be fixed on main though by https://github.com/percona/mongodb_exporter/commit/a24ec48a9bd6fc6275deae50f25740c446fb4512 which updates the mongodb go driver. The mongodb go driver folks note:

This release contains a bug fix to allow the loading of multiple certs within a single PEM file.

https://github.com/mongodb/mongo-go-driver/releases/tag/v1.8.3

Any possibility a new release of mongodb_exporter can be cut soon? This will save us from having to keep a hand-built binary around... @denisok @JiriCtvrtka ?

ShashankSinha252 commented 2 years ago

We plan to release a new version of MongoDB exporter soon @mukerjee . Please check out 0.31.0 for updates on our progress for new release.

denisok commented 2 years ago

@mukerjee was it fixed with latest releases?

mukerjee commented 2 years ago

Unfortunately we're not using mongodb in our project anymore so i don't have a quick way to check this. I would assume it's fixed though on a new release, because it worked for me before as long as I had commit a24ec48a9bd6fc6275deae50f25740c446fb4512