openresty / openresty/lua-nginx-module

nginx + lua-mongo gives SSL error protocol mongodb+srv

Open
#1,801 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
11.8k
Forks
2.1k
Avg merge
6h 1m
Merged PRs (30d)
6

Description

If I use lua-mongo package stand alone under lua or luajit everthing works fine.
If I use code under nginx

content_by_lua_block {
local mongo = require 'mongo'

local mongo_url = "mongodb+srv://user:password@cluster0.xxxxx.mongodb.net/dbname?retryWrites=true&w=majority"
local sub_url = nil
sub_url = mongo_url
local found_query_sign = string.find(mongo_url, "?")
if found_query_sign then
  sub_url = string.sub(mongo_url, 0, found_query_sign  - 1)
end
local mongo_db = string.sub(string.match(sub_url, "/[%w\\_\\-]+$"), 2)
ngx.say("mongo_db=", mongo_db)
local client = assert(mongo.Client(mongo_url))

local users_collection = assert(client:getCollection(mongo_db, 'users'))

for person in users_collection:find({}):iterator() do
    ngx.say(person.usernamename)
end
}

the it gives an error

2020/10/09 08:06:23 [error] 1421#0: *51 lua entry thread aborted: runtime error: content_by_lua(nginx-kong.conf:283):24: No suitable servers found (serverSelectionTryOnce set): [TLS handshake failed: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed calling ismaster on 'cluster0-shard-00-00.xxxxx.mongodb.net:27017'] [TLS handshake failed: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed calling ismaster on 'cluster0-shard-00-01.xxxxx.mongodb.net:27017'] [TLS handshake failed: error:1416F086:SSL routines:tls_process_server_certificate:certificate

No error if SSL is not used. Plain mongodb://foo works fine.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the content_by_lua_block example and the failing call at nginx-kong.conf:283, then reproduce the contrast between standalone Lua or LuaJIT and nginx. Trace mongo.Client(mongo_url) with the mongodb+srv URL and compare the TLS handshake behavior; done means the nginx case connects without certificate verification errors while plain mongodb:// behavior remains working.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, mongodb, nginx
Domain
backend, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.