Mongo Replicaset监控用IP替换主机名导致主机名验证失败
我们的 mongo java 驱动程序和监控线程有问题。
我们正在运行一个 3 服务器副本集，并使用主机名连接我们的 Spring Boot 微服务。 mongodb://
到目前为止，我们一直使用非响应式 mongo 驱动程序，一切正常。然而，我现在想使用reactive/netty版本，并且我们得到了java.security.cert.CertificateException，因为它尝试通过IP而不是主机名来验证替代名称。
我通过库进行了调试，并且能够看到当 Replicaset 线程的监控线程启动时，它们正在接收带有 IP 而不是主机名的 {hello: 1} 。
- 监控线程通过主机名连接 -->一切正常
- 随着监控线程的第一个状态请求，它们接收作为 IP 的主机
- Mongo 驱动程序使用 IP 地址更新监控集群的副本集并删除主机名
- 启动 IP 的新监控线程并尝试 hello 命令
- 由于 IP 进行主机名验证，命令失败
似乎这适用于非反应式，因为 IP 由 Inet4Address 解析，因此再次获得正确的主机名。
有人有解决方案吗？ 除了
- 添加 IP 作为证书的替代名称（IP 可能会更改）
- 允许无效主机名（sslInvalidHostNameAllowed 选项）
之外，我们是否可能在服务器端配置某些内容，以便 mongo 返回主机名而不是 IP？
预先感谢您。
we have a problem with the mongo java driver and the monitoring thread.
We are running a 3 server replicaset and connect our spring boot microservices by using the hostnames.mongodb://<username>:<password>@A:27017,B:27017,C:27017/?tls=true
Up until now we always used the non-reactive mongo driver and everything is working fine. However I now wanted to use the reactive/netty version and we're getting a java.security.cert.CertificateException because it tries to validate the alternative names by IP instead of the hostnames.
I debugged through the the libraries and were able to see that when the Monitoring threads for Replicaset threads start, they are receiving the {hello: 1} with IPs instead of hostnames.
- Monitoring threads connect through hostnames --> Everything works
- With the first status request of the monitoring threads, they receive the hosts as IPs
- Mongo driver updates replicaset of monitoring cluster with IP addresses and removes hostnames
- New monitoring threads for IPs are started and try hello command
- Command fails because of hostname verification by IP
Seems like this works for non-reactive because the IP is resolved by Inet4Address and therefore gets the correct hostname again.
Does anyone have a solution for this?
Apart from
- Adding IPs as alternative names to certificates (IPs may change)
- Allowing invalid hostnames (sslInvalidHostNameAllowed option)
Is there maybe something we configure on server-side so the mongo return hostnames instead of IPs?
Thanky you in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
显然我们的复制集在我们的环境之一中配置错误。
bindIp 设置为 IP 地址而不是主机名（这可能没有区别），但副本集也使用 IP 地址而不是主机名进行初始化。
将所有成员主机的属性更新为主机名后，它会按预期工作。
Apparently our replicaset was misconfigured in one of our environments.
The bindIp was set to the ip address and not hostname (which probably makes no difference), but the replicaset was also initialized with ip addresses instead of hostnames.
After updating all members host's property to the hostname it works like expected.