Connecting to MongoDB with client-side SSL

Trying to connect the latest metabase version to a MongoDB instance that expects a client-side SSL cert, and cannot get it to work (after trying many possible configurations). I would expect it to be a pretty standard scenario and not sure why it doesn’t work.

Metabase is launched with the following command:
docker run -d -p 8443:8443 -e ‘MB_JETTY_SSL=true’ -e ‘MB_JETTY_SSL_Port=8443’ -e ‘MB_JETTY_SSL_Keystore=/app/client.jks’ -e ‘MB_JETTY_SSL_Keystore_Password=password’ --name metabase metabase/metabase

Logs are as follows:

Metabase logs:
com.mongodb.MongoTimeoutException: Timed out after 3000 ms while waiting to connect. Client view of cluster state is {type=UNKNOWN, servers=[{address=:27017, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketReadException: Prematurely reached end of stream}}]

Mongo logs:
I NETWORK [thread1] connection accepted from :47294 #30 (25 connections now open)
I - [conn30] AssertionException handling request, closing client connection: 17189 The server is configured to only allow SSL connections

The SSL cert itself seems ok since I can use it successfully when connecting with a simple Mongo client.

Searching this forum, I see earlier reports on a similar issue that the newest metabase version is supposed to fix, but looks like it’s still not working in my case with this newest version.

Anybody tried this configuration before and seen it working? Happy to try any suggestions anybody may have.

Hi @AlexB

Which version of Metabase?

I might be misunderstanding something, since I’m not using MongoDB, but those environment variables you’re using to run Docker, doesn’t have anything to do with the configuration of the database.
Those variables are for enabling https on Jetty (the internal web server).

Do you have ssl=true in your connection string in the database configuration? (Admin > Databases)

Are you running a self-signed certificate on your MongoDB? If yes, then you’re probably seeing this issue:
Or maybe using Atlas Cluster, that was fixed in 0.32.9:

Thanks @flamber for the quick reply. Some clarifications for now, but we’ll be running additional testing in parallel:
The metabase version is the latest one on the hub, which I think it 0.32.9. I don’t know if the 0.33 preview has any additional fixes in that area.
ssl=true is on the connection string.
And we are following the suggestion in for sure, just doesn’t seem to work for us.

Okay, so you are using a self-signed certificate?
If it’s easier to test with a plain JAR-file, then do that to begin with - then you can always figure out how to make the same configuration for Docker.

Same here.

We have an internal certificate authority we use for issuing sever-side and client-side certs.
The connection configuration form allows to set the ssl flag and a custom ca, but doesn’t have a way for configuring the client cert, that way.
Trying to setup the certificates via uri doesn’t work either (mongodb://

has anyone been successful connecting metabase to mongo with client side certificates?

@danielt Is the custom CA certificate chained - otherwise you need to add the root CA to the certificate.
Have you tried connecting with any other JDBC tool like ?

Thanks, @flamber!!

Is the custom CA certificate chained?

yep, tried and working all over the place, metabase is one of our latest additions to the stack.

Have you tried connecting with any other JDBC tool like

nope, we mainly use python and node around here and pretty much every other tool we use with mongo uses c drivers.

@danielt Okay, which JDBC URI would you use to do what you want? If JDBC doesn’t support it, then there isn’t anything Metabase can do.

@flamber I’m not sure about the mongo jdbc implementing this this way. I opened a github issue with the request for a way for setting this up, but with little hopes.

Seems like we are going to export the data somewhere else and connect it to metabase that other way.

Thanks for your help!!

@danielt It would be very helpful if you can figure out which JDBC works - use DBeaver - then that puts us on the right track. Looks like this is what you’re after: