MongoDB gives certificate not trusted while openSSL says keys is OK I have used let's encrypt to generate SSL certification. All the private key, chain and certificate is generated by `let's encrypt.

Now to use it in MongoDB I first merged privkey.pem and cert.pem into a file called mongo.pem:

cat /etc/dehydrated/certs/mongo.example.com/privkey.pem /etc/dehydrated/certs/mongo.example.com/cert.pem &gt; /etc/ssl/mongo.pem


Now using openssl I converted ca.crt into ca.pem:

sudo touch /etc/ssl/ca.pem
sudo chmod 777 /etc/ssl/ca.pem
sudo truncate -s 0 /etc/ssl/ca.pem
sudo openssl x509 -in /etc/ssl/ca.crt -out /etc/ssl/ca.pem -outform PEM


Now a file is created called ca.pem in /etc/ssl path. Finally I append chain file content to the end of ca.pem:

sudo cat /etc/dehydrated/certs/mongo.example.com/chain.pem &gt;&gt; /etc/ssl/ca.pem


Now to verify the key I used openssl is below:

openssl verify -verbose -CAfile /etc/ssl/ca.pem /etc/ssl/mongo.pem


The output is:

/etc/ssl/mongo.pem: OK


It's good to note that I have done the same exact procedure on another server and it went all ok and MongoDB works as expected.

Now my MongoDB config is as below:

ssl:
    mode: preferSSL
    PEMKeyFile: /etc/ssl/mongo.pem
    CAFile: /etc/ssl/ca.pem


NOTE: My mongoDB is a single primary node in which replication is enabled (Use to capture changes on DB)

Now when I restart MongoDB it gives error below:

A member of a replica set enters RECOVERING state when it is not ready to accept reads. The RECOVERING state can occur during normal operation, and doesn’t necessarily reflect an error condition. Members in the RECOVERING state are eligible to vote in elections, but are not eligible to enter the PRIMARY state.

2018-05-15T18:26:00.171+0000 E NETWORK  [conn1] SSL peer certificate validation failed: certificate not trusted
2018-05-15T18:26:00.171+0000 W NETWORK  [replexec-0] couldn't check isSelf (mongo:27017) socket exception [CONNECT_ERROR] for SSL peer certificate validation failed: certificate not trusted
2018-05-15T18:26:00.171+0000 I NETWORK  [conn1] Error receiving request from client: SSLHandshakeFailed: SSLHandshakeFailed. Ending connection from 127.0.0.1:47454 (connection id: 1)
2018-05-15T18:26:00.171+0000 I NETWORK  [conn1] end connection 127.0.0.1:47454 (0 connections now open)
2018-05-15T18:26:00.171+0000 E NETWORK  [replexec-0] SSL peer certificate validation failed: certificate not trusted
2018-05-15T18:26:00.172+0000 I REPL     [replexec-0] This node is not a member of the config
2018-05-15T18:26:00.172+0000 I REPL     [replexec-0] transition to REMOVED from STARTUP


Modules cannot connect to MongoDB and reports:

OperationFailure: node is not in primary or recovering state


Now I do not have access to primary node and it cannot show my dbs. When I disable SSL, everything works and node gets back to primary state. Why is this happening, while I have done the exact same thing on a node in another datacenter?
I changed hostname from mongo to mongo.my_domain.com. Moreover SSL keys are generated for mongo.my_domain.com. Mongo is now up and running with SSL.