Unable to connect MongoDB with TLS

Description:

Rocketchat fails to connect to MongoDB with TLS.

Steps to reproduce:

1. set MONGO_URL='mongodb://rocketchat:password@db.leafia.net:27017/rocketchat?replicaSet=rs01&authSource=rocketchat&tls=true
2. set MONGO_OPLOG_URL='mongodb://rocketchat:password@db.leafia.net:27017/local?replicaSet=rs01&authSource=rocketchat&tls=true
3. start rocketchat
4. or set MONGO_URL='mongodb+srv://rocketchat:password@db.leafia.net/rocketchat?replicaSet=rs01&authSource=rocketchat
5. set MONGO_OPLOG_URL='mongodb+srv://rocketchat:password@db.leafia.net/local?replicaSet=rs01&authSource=rocketchat
6. start rocketchat

Expected behavior:

connecting to MongoDB successfully.

Actual behavior:

An error happens as below:

Server Setup Information:

• Version of Rocket.Chat Server: 6.1.5
• Operating System: Debian 11.7
• Deployment Method: tar
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version: v14.21.2
• MongoDB Version: 6.0.5

Relevant logs:

May  3 11:56:32 ls systemd[1]: Started The Rocket.Chat server.
May  3 11:57:04 ls start.sh[184528]: /srv/Rocket.Chat/bundle-6.1.5/programs/server/node_modules/fibers/future.js:313
May  3 11:57:04 ls start.sh[184528]: #011#011#011#011#011#011throw(ex);
May  3 11:57:04 ls start.sh[184528]: #011#011#011#011#011#011^
May  3 11:57:04 ls start.sh[184528]: MongoServerSelectionError: Hostname/IP does not match certificate's altnames: IP: 45.42.200.86 is not in the cert's list:
May  3 11:57:04 ls start.sh[184528]:     at Timeout._onTimeout (/srv/Rocket.Chat/bundle-6.1.5/programs/server/npm/node_modules/meteor/npm-mongo/node_modules/mongodb/lib/sdam/topology.js:292:38)
May  3 11:57:04 ls start.sh[184528]:     at listOnTimeout (internal/timers.js:557:17)
May  3 11:57:04 ls start.sh[184528]:     at processTimers (internal/timers.js:500:7) {
May  3 11:57:04 ls start.sh[184528]:   reason: TopologyDescription {
May  3 11:57:04 ls start.sh[184528]:     type: 'ReplicaSetNoPrimary',
May  3 11:57:04 ls start.sh[184528]:     servers: Map(1) {
May  3 11:57:04 ls start.sh[184528]:       '45.42.200.86:27017' => ServerDescription {
May  3 11:57:04 ls start.sh[184528]:         address: '45.42.200.86:27017',
May  3 11:57:04 ls start.sh[184528]:         type: 'Unknown',
May  3 11:57:04 ls start.sh[184528]:         hosts: [],
May  3 11:57:04 ls start.sh[184528]:         passives: [],
May  3 11:57:04 ls start.sh[184528]:         arbiters: [],
May  3 11:57:04 ls start.sh[184528]:         tags: {},
May  3 11:57:04 ls start.sh[184528]:         minWireVersion: 0,
May  3 11:57:04 ls start.sh[184528]:         maxWireVersion: 0,
May  3 11:57:04 ls start.sh[184528]:         roundTripTime: -1,
May  3 11:57:04 ls start.sh[184528]:         lastUpdateTime: 175195001,
May  3 11:57:04 ls start.sh[184528]:         lastWriteDate: 0,
May  3 11:57:04 ls start.sh[184528]:         error: MongoNetworkError: Hostname/IP does not match certificate's altnames: IP: 45.42.200.86 is not in the cert's list:
May  3 11:57:04 ls start.sh[184528]:             at connectionFailureError (/srv/Rocket.Chat/bundle-6.1.5/programs/server/npm/node_modules/meteor/npm-mongo/node_modules/mongodb/lib/cmap/connect.
js:387:20)
May  3 11:57:04 ls start.sh[184528]:             at TLSSocket.<anonymous> (/srv/Rocket.Chat/bundle-6.1.5/programs/server/npm/node_modules/meteor/npm-mongo/node_modules/mongodb/lib/cmap/connect.j
s:310:22)
May  3 11:57:04 ls start.sh[184528]:             at Object.onceWrapper (events.js:520:26)
May  3 11:57:04 ls start.sh[184528]:             at TLSSocket.emit (events.js:400:28)
May  3 11:57:04 ls start.sh[184528]:             at emitErrorNT (internal/streams/destroy.js:106:8)
May  3 11:57:04 ls start.sh[184528]:             at emitErrorCloseNT (internal/streams/destroy.js:74:3)
May  3 11:57:04 ls start.sh[184528]:             at processTicksAndRejections (internal/process/task_queues.js:82:21) {
May  3 11:57:04 ls start.sh[184528]:           cause: Error [ERR_TLS_CERT_ALTNAME_INVALID] [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: IP: 45.42.200.86 is 
not in the cert's list:
May  3 11:57:04 ls start.sh[184528]:               at new NodeError (internal/errors.js:322:7)
May  3 11:57:04 ls start.sh[184528]:               at Object.checkServerIdentity (tls.js:347:12)
May  3 11:57:04 ls start.sh[184528]:               at TLSSocket.onConnectSecure (_tls_wrap.js:1525:27)
May  3 11:57:04 ls start.sh[184528]:               at TLSSocket.emit (events.js:400:28)
May  3 11:57:04 ls start.sh[184528]:               at TLSSocket._finishInit (_tls_wrap.js:937:8)
May  3 11:57:04 ls start.sh[184528]:               at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:709:12) {
May  3 11:57:04 ls start.sh[184528]:             reason: "IP: 45.42.200.86 is not in the cert's list: ",
May  3 11:57:04 ls start.sh[184528]:             host: '45.42.200.86',
May  3 11:57:04 ls start.sh[184528]:             cert: [Object],
May  3 11:57:04 ls start.sh[184528]:             code: 'ERR_TLS_CERT_ALTNAME_INVALID'
May  3 11:57:04 ls start.sh[184528]:           },
May  3 11:57:04 ls start.sh[184528]:           [Symbol(errorLabels)]: Set(1) { 'ResetPool' }
May  3 11:57:04 ls start.sh[184528]:         },
May  3 11:57:04 ls start.sh[184528]:         topologyVersion: null,
May  3 11:57:04 ls start.sh[184528]:         setName: null,
May  3 11:57:04 ls start.sh[184528]:         setVersion: null,
May  3 11:57:04 ls start.sh[184528]:         electionId: null,
May  3 11:57:04 ls start.sh[184528]:         logicalSessionTimeoutMinutes: null,
May  3 11:57:04 ls start.sh[184528]:         primary: null,
May  3 11:57:04 ls start.sh[184528]:         me: null,
May  3 11:57:04 ls start.sh[184528]:         '$clusterTime': null
May  3 11:57:04 ls start.sh[184528]:       }
May  3 11:57:04 ls start.sh[184528]:     },
May  3 11:57:04 ls start.sh[184528]:     stale: false,
May  3 11:57:04 ls start.sh[184528]:     compatible: true,
May  3 11:57:04 ls start.sh[184528]:     heartbeatFrequencyMS: 10000,
May  3 11:57:04 ls start.sh[184528]:     localThresholdMS: 15,
May  3 11:57:04 ls start.sh[184528]:     setName: 'rs01',
May  3 11:57:04 ls start.sh[184528]:     maxElectionId: ObjectId {
May  3 11:57:04 ls start.sh[184528]:       [Symbol(id)]: Buffer(12) [Uint8Array] [
May  3 11:57:04 ls start.sh[184528]:         127, 255, 255, 255, 0,
May  3 11:57:04 ls start.sh[184528]:           0,   0,   0,   0, 0,
May  3 11:57:04 ls start.sh[184528]:           0,  10
May  3 11:57:04 ls start.sh[184528]:       ]
May  3 11:57:04 ls start.sh[184528]:     },
May  3 11:57:04 ls start.sh[184528]:     maxSetVersion: 2,
May  3 11:57:04 ls start.sh[184528]:     commonWireVersion: 0,
May  3 11:57:04 ls start.sh[184528]:     logicalSessionTimeoutMinutes: null
May  3 11:57:04 ls start.sh[184528]:   },
May  3 11:57:04 ls start.sh[184528]:   code: undefined,
May  3 11:57:04 ls start.sh[184528]:   [Symbol(errorLabels)]: Set(0) {}
May  3 11:57:04 ls start.sh[184528]: }
May  3 11:57:04 ls systemd[1]: rocketchat.service: Main process exited, code=exited, status=1/FAILURE
May  3 11:57:04 ls systemd[1]: rocketchat.service: Failed with result 'exit-code'.
May  3 11:57:04 ls systemd[1]: rocketchat.service: Consumed 3.255s CPU time.

The report names no repository source file or test; begin by reproducing the TLS connection with the listed MONGO_URL and MONGO_OPLOG_URL values and versions. Inspect the logged MongoDB driver locations in programs/server/npm/node_modules/meteor/npm-mongo/node_modules/mongodb/lib/sdam/topology.js and connect.js, and consider the work done only when the intended TLS connection succeeds or the failure is clearly handled.