[DRIVERS-2190] mongo-orchestration client.pem cert uses outdated hash algorithm Created: 04/Feb/22  Updated: 28/Oct/23  Resolved: 23/Feb/22

Status: Closed
Project: Drivers
Component/s: Mongo Orchestration
Fix Version/s: None

Type: Task Priority: Unknown
Reporter: Jeremy Mikola Assignee: Jeremy Mikola
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Related
is related to DRIVERS-575 Regenerate test certificates with SHA... Closed
Driver Changes: Not Needed

 Description   

Certificates in drivers-evergreen-tools were regenerated with SHA256 a few years ago for DRIVERS-575.

mongo-orchestration is still using an old client.pem cert, which dates back seven years to 10gen/mongo-orchestration@60ab9d2. This cert appears to be injected into every internal PyMongo client whenever a configuration uses sslParams (see: common.py, sharded_clusters.py).

On my local system (Python 3.8.10, OpenSSL 1.1.1f), attempting to start an SSL cluster (e.g. load-balancer-ssl.json) emits the following error:

Traceback (most recent call last):
  File "/home/jmikola/.local/lib/python3.8/site-packages/pymongo/ssl_support.py", line 128, in get_ssl_context
    ctx.load_cert_chain(certfile, keyfile, passphrase)
ssl.SSLError: [SSL: CA_MD_TOO_WEAK] ca md too weak (_ssl.c:4046)
 
During handling of the above exception, another exception occurred:
 
Traceback (most recent call last):
...
  File "/home/jmikola/.local/lib/python3.8/site-packages/pymongo/ssl_support.py", line 130, in get_ssl_context
    raise ConfigurationError(
pymongo.errors.ConfigurationError: Private key doesn't match certificate: [SSL: CA_MD_TOO_WEAK] ca md too weak (_ssl.c:4046)

Presumably, this can be fixed by regenerating the certificate in the mongo-orchestration repository, or just copying over one of the existing certs from drivers-evergreen-tools' x509gen directory.



 Comments   
Comment by Jeremy Mikola [ 23/Feb/22 ]

https://github.com/10gen/mongo-orchestration/commit/d428270994607a697ca0e5a9aa37a2c3a470dd3b

Comment by Jeremy Mikola [ 22/Feb/22 ]

https://github.com/10gen/mongo-orchestration/pull/290

Generated at Thu Feb 08 08:24:57 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.