If ssl_ca_cert options is present, MongoID will use SSL no matter there is no ssl=true in URI

[jerko-culina]

Hi,

• I had some issues trying to connect to MongoDb Atlas.
• On bugsnag I was getting no primary prefered server available error
• once i get access to server, i tried to connect using mongo-ruby-driver and it worked fine
• then i tried to connect using MongoID in rails console, and there it failed, but error was different, it was logging SSL related error

MONGODB | Error checking osnonprod-shard-00-01.depsp.mongodb.net:27017: OpenSSL::X509::StoreError: X509_LOOKUP_load_file: system lib

• i removed ssl=true from URI but still was getting same ssl related error
• then i removed ssl_ca_cert options from mongoid.yml and tried again, and it worked.
• not sure if it is feature or bug, but wanted to mention here, so you can decide if it is fine or something has to be done about that.
• two things:
  • maybe i am wrong, but somehow i get expectation that if there is no ssl=true in URI, then ssl will not be used, maybe it is just me, but from everything i read i got this kind of expectation
  • also, error raised that was reported by bugnsag was NoServerAvailable but here I would expect something like ConnectionFailed or similar

again, could be it is just me and that I am wrong, in that case: I am sorry! 😞

Anyway, big thanks for all great work you all did creating this library! 🥇 🙂

[alexbevi]

Hey @jerko-culina,

Just a quick note since I can see you're connecting to an Atlas cluster, if you're using the SRV connection string (ex: mongodb+srv://osnonprod.depsp.mongodb.net), this URI scheme uses DNS to perform queries to supply the connection string options (a TXT and an SRV query).

The SRV query would provide the seedlist of hosts for your replica set as follows:

$ nslookup -type=SRV _mongodb._tcp.osnonprod.depsp.mongodb.net
[...]
_mongodb._tcp.osnonprod.depsp.mongodb.net       service = 0 0 27017 osnonprod-shard-00-02.depsp.mongodb.net.
_mongodb._tcp.osnonprod.depsp.mongodb.net       service = 0 0 27017 osnonprod-shard-00-00.depsp.mongodb.net.
_mongodb._tcp.osnonprod.depsp.mongodb.net       service = 0 0 27017 osnonprod-shard-00-01.depsp.mongodb.net.

and the TXT query would supply the additional options

$ nslookup -type=TXT osnonprod.depsp.mongodb.net
[...]
osnonprod.depsp.mongodb.net     text = "authSource=admin&replicaSet=atlas-2e4wmx-shard-0"

You may notice that there is no ssl=true or tls=true option in the TXT record ... but it's actually still there. This behavior is all described in the Initial DNS Seedlist Discovery specification:

If mongodb+srv is used, a driver MUST implicitly also enable TLS. Clients can turn this off by passing tls=false in either the Connection String, or options passed in as parameters in code to the MongoClient constructor (or equivalent API for each driver), but not through a TXT record (discussed in a later section).

Essentially, it's not a bug, but a feature :)

Removing ssl=true wouldn't work if mongodb+srv is being used, but passing ssl=false would.

If you're NOT using the mongodb+srv URI scheme however, let us know as there may be more digging to do.

[jerko-culina]

Thanks a lot for clarification. Yes, I am using mongodb+srv.