Connecting pymongo client to mongodb server with TLS - python-3.x

Question

I have 2 instances on Google Cloud :
Instance A and Instance B - Both have a static external IP address.
Instance A running the community edition of the MongoDB server v4.4.6.
I have generated self-signed certificates to enable TLS
I have set the firewall rules in my cloud network to allow traffic to the MongoDB port from Instance Bs IP address
As such, I am successfully able to use the mongo shell(v4.4.6) in Instance B to connect to the mongo server running on Instance A. This is the command that I use -
mongo --tls --tlsCertificateKeyFile client.pem --tlsCAFile ca.pem <instance_a_ip>:<port>/admin -u <userName> -p
I would like to use the pymongo(v3.11.4) client from Instance B in order to connect to my MongoDB server in Instance A and I have tried that using this in an interactive python shell -
client = MongoClient("mongodb://<instance_a_ip>:<port>/admin", tls=True, tlsCertificateKeyFile='./client.pem', tlsCAFile='./ca.pem', username='<userName>', password='<userPassword>')
However, I am not able to connect and this is the error that I receive -
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/home/varun/test-env/lib/python3.8/site-packages/pymongo/collection.py", line 1319, in find_one
for result in cursor.limit(-1):
File "/home/varun/test-env/lib/python3.8/site-packages/pymongo/cursor.py", line 1207, in next
if len(self.__data) or self._refresh():
File "/home/varun/test-env/lib/python3.8/site-packages/pymongo/cursor.py", line 1100, in _refresh
self.__session = self.__collection.database.client._ensure_session()
File "/home/varun/test-env/lib/python3.8/site-packages/pymongo/mongo_client.py", line 1816, in _ensure_session
return self.__start_session(True, causal_consistency=False)
File "/home/varun/test-env/lib/python3.8/site-packages/pymongo/mongo_client.py", line 1766, in __start_session
server_session = self._get_server_session()
File "/home/varun/test-env/lib/python3.8/site-packages/pymongo/mongo_client.py", line 1802, in _get_server_session
return self._topology.get_server_session()
File "/home/varun/test-env/lib/python3.8/site-packages/pymongo/topology.py", line 496, in get_server_session
self._select_servers_loop(
File "/home/varun/test-env/lib/python3.8/site-packages/pymongo/topology.py", line 215, in _select_servers_loop
raise ServerSelectionTimeoutError(
pymongo.errors.ServerSelectionTimeoutError: <instance_a_ip>:<port>: ("Invalid DNS pattern b'127.0.0.1'.",), Timeout: 30s, Topology Description: <TopologyDescription id: 60ad03827b267af40c2edf4b, topology_type: Single, servers: [<ServerDescription ('<instance_a_ip>', <port>) server_type: Unknown, rtt: None, error=AutoReconnect('<instance_a_ip>:<port>: ("Invalid DNS pattern b\'127.0.0.1\'.",)')>]>
I am new to MongoDB and not able to figure out how to go about this, help would be greatly appreciated.

Answer 1

Debugged the issue by installing the Nodejs client for MongoDB. The Node client provided a much better message upon failure -
[Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: IP: 34.126.133.72 is not in the cert's list
Thanks to the meaningful error, I read through the OpenSSL configuration file that I had used while creating the self-signed certificates. Rectified the error I made in the config file as such -
Original config file which caused the error
[ v3_req ]
subjectAltName = #alt_names
[ alt_names ]
DNS.1 = 127.0.0.1
DNS.2 = <instance_a_ip>
Rectified config file which now works with all MongoDB clients
[ v3_req ]
subjectAltName = #alt_names
[ alt_names ]
IP.1 = 127.0.0.1
IP.2 = <instance_a_ip>

Answer 2

Your certificate is self-signed, add this option when create MongoClient.
tlsInsecure=True
code will be like this
client = MongoClient(
["<instance_a_ip>:<port>"],
tls=True,
tlsInsecure=True,
tlsCertificateKeyFile='./client.pem',
tlsCAFile='./ca.pem',
username='<userName>',
password='<userPassword>'
)