Connecting to MongoDb with SSL from JAVA app

Both the approaches mentioned below usually suggested on forums will 'work' but are not secure as they disable the host-name verification essentially negating the SSL. Hence they are not recommended especially if your code would be deployed on production:

// 1. For any HTTPS connection
    javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(
        new javax.net.ssl.HostnameVerifier(){
            public boolean verify(String hostname,
                javax.net.ssl.SSLSession sslSession) {
                    if(hostname.equals("<hostname>")) {
                        return true; 
                    }
                }
            });

// 2. MongoDB SSL specific 
MongoClientOptions.builder().sslEnabled(true).sslInvalidHostNameAllowed(true).build();

Refer: https://wiki.openssl.org/index.php/Hostname_validation

To fix this, you'll need a certificate containing the DNS of the server as a Subject Alternative Name entry, which you can import to your JDK cacerts

Alternatively, if you want establish SSL at the application level, I'd recommend creating a SSLContext for that particular connection instead of using System.setProperty() for setting key-stores/trust-stores. This would help in avoiding conflicts if your application connects to different external services who have different SSL implementations.

Specifically for MongoDB, you would just need to append ?ssl=true at the end of the MongoDBURI after the above mentioned step. If it still doesn't work, I'd recommend updating your JDK version as per https://jira.mongodb.org/browse/JAVA-2184

Hope this helps

You need to configure the monog db driver to use SSL. You can do this with configuring it manually in a @Configuration class.

    public @Bean MongoClient mongo()  {
        MongoClientOptions.Builder options = MongoClientOptions.builder().sslEnabled(true);
        // add more options to the builder with your config
        MongoClient mongoClient = new MongoClient("localhost", options.build());
        return mongoClient;
    }

If you are using RAD with WAS local servers, you have to add the pem file to the java VM for that server.

So if you have WAS installed to X:\IBM\WASx, X:\IBM\WASx\java_17\jre is the directory that you would navigate and then execute the keytool import there. Hope this helps others.

Please check below code for MongoDB Java Driver 4.x and MongoDB 3.x

Where you have to configure spring.data.mongodb.xxxx properties as per your MongoDB.

import java.util.Arrays;
import java.util.List;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import com.mongodb.MongoClientSettings;
import com.mongodb.MongoCredential;
import com.mongodb.ServerAddress;
import com.mongodb.client.MongoClient;
import com.mongodb.client.MongoClients;

@Configuration
public class MongoClientConfig {

    @Value("${spring.data.mongodb.username}")
    private String user;
    
    @Value("${spring.data.mongodb.password}")
    private char[] password;
    
    @Value("${spring.data.mongodb.host}")
    private String host;
    
    @Value("${spring.data.mongodb.port}")
    private int port;
    
    @Value("${spring.data.mongodb.database}")
    private String database;
    
    @Bean
    public MongoClient mongo() {
        List<ServerAddress> hosts = Arrays.asList(new ServerAddress(host, port));
        MongoCredential credential = MongoCredential.createCredential(user, database, password);

        MongoClientSettings settings = MongoClientSettings.builder().credential(credential)
                .applyToSslSettings(builder -> builder.enabled(true))
                .applyToClusterSettings(builder -> builder.hosts(hosts)).build();
        MongoClient mongoClient = MongoClients.create(settings);
        System.out.println("====================================================================");
        System.out.println("========= MongoClientConfig: " + mongoClient.toString() + "=========");
        System.out.println("====================================================================");
        return mongoClient;
    }
}

1. I download a openssl program from here and install it
2. i open a cmd in the foler of my Pem file certiface.pem
   and i run a command :

DIRECTION\OpenSSL\bin\openssl pkcs12 -export -out keystore.pkcs12 -in certiface.pem

on password you put what you want example: blabla should create a file name keystore.pkcs12

3. run the command on cmd

keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS

on passwords i put blabla check that created file keystore.jks

4. now my code

         System.setProperty("javax.net.ssl.keyStore", keystore.jks);
         System.setProperty("javax.net.ssl.keyStorePassword", "blabla");
         MongoClient mongoClient = MongoClients.create("mongodb+srv://YOURLINK.mongodb.net/?authSource=%24external&authMechanism=MONGODB-X509&retryWrites=true&w=majority");
         database = mongoClient.getDatabase("DatabaseName");
   

Here is a complete implementation of how to connect to MongoDB/DocDB over ssl using mongoUri and sslCertificates. In this implementation, the application itself creates the keystore file and imports the certificate into it. So, there is no need to do any server side changes (in most cases). https://github.com/BarathArivazhagan/spring-boot-aws-documentdb

As Redlab mentioned in the code, it can be disabled for restricting ssl validation. Specially this case comes on local setup. No extra effort required to do.

public @Bean MongoClient mongo()  {
    MongoClientOptions.Builder options = MongoClientOptions.builder().sslEnabled(false);
    // add more options to the builder with your config
    MongoClient mongoClient = new MongoClient("localhost", options.build());
    return mongoClient;
}

just I modified-- sslEnabled(true) ===> sslEnabled(false).