openresty / openresty/lua-nginx-module
nginx + lua-mongo gives SSL error protocol mongodb+srv
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 11.8k
- Forks
- 2.1k
- Avg merge
- 6h 1m
- Merged PRs (30d)
- 6
Description
If I use lua-mongo package stand alone under lua or luajit everthing works fine.
If I use code under nginx
content_by_lua_block {
local mongo = require 'mongo'
local mongo_url = "mongodb+srv://user:password@cluster0.xxxxx.mongodb.net/dbname?retryWrites=true&w=majority"
local sub_url = nil
sub_url = mongo_url
local found_query_sign = string.find(mongo_url, "?")
if found_query_sign then
sub_url = string.sub(mongo_url, 0, found_query_sign - 1)
end
local mongo_db = string.sub(string.match(sub_url, "/[%w\\_\\-]+$"), 2)
ngx.say("mongo_db=", mongo_db)
local client = assert(mongo.Client(mongo_url))
local users_collection = assert(client:getCollection(mongo_db, 'users'))
for person in users_collection:find({}):iterator() do
ngx.say(person.usernamename)
end
}
the it gives an error
2020/10/09 08:06:23 [error] 1421#0: *51 lua entry thread aborted: runtime error: content_by_lua(nginx-kong.conf:283):24: No suitable servers found (serverSelectionTryOnce set): [TLS handshake failed: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed calling ismaster on 'cluster0-shard-00-00.xxxxx.mongodb.net:27017'] [TLS handshake failed: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed calling ismaster on 'cluster0-shard-00-01.xxxxx.mongodb.net:27017'] [TLS handshake failed: error:1416F086:SSL routines:tls_process_server_certificate:certificate
No error if SSL is not used. Plain mongodb://foo works fine.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the content_by_lua_block example and the failing call at nginx-kong.conf:283, then reproduce the contrast between standalone Lua or LuaJIT and nginx. Trace mongo.Client(mongo_url) with the mongodb+srv URL and compare the TLS handshake behavior; done means the nginx case connects without certificate verification errors while plain mongodb:// behavior remains working.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, mongodb, nginx
- Domain
- backend, networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100