# How to use pbm-agent with client tls

**URL:** <https://forums.percona.com/t/how-to-use-pbm-agent-with-client-tls/11237>\
**Category:** Percona Backup for MongoDB\
**Tags:** closed-no-reply\
**Created:** [July 6, 2021, 10:43pm UTC](https://forums.percona.com/t/how-to-use-pbm-agent-with-client-tls/11237 "2021-07-06T22:43:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kylem](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/kylem/32/3748_2.png) [@kylem](https://forums.percona.com/u/kylem)\
**Post date:** [July 6, 2021, 10:43pm UTC](https://forums.percona.com/t/how-to-use-pbm-agent-with-client-tls/11237/1 "2021-07-06T22:43:17Z")

</div>

Hi there.

I have a Percona replica set with `requireTLS`, which I would like to backup with `pbm`. At the moment I am struggling to connect to my cluster when providing tls options in the connection string. I am able to connect using the same options when connecting with the mongo shell.

mongo shell: `mongo --authenticationMechanism MONGODB-X509 --tls --host localhost --tlsCertificateKeyFile path/tls.crt --tlsCAFile path/ca.pem`

mongod logs:

```auto
"NETWORK", "msg":"Connection accepted"
"ACCESS", "ctx":"conn464","msg":"Authenticate"
"ACCESS", "msg":"Successfully authenticated"

```

The above works as expected, and I am in a shell as the user specified in the x509 certificate subject name.

Now, when using pbm: `PBM_MONGODB_URI=mongodb://localhost:27017/?tls=true&authenticationMechanism=MONGODB-X509&tlsCertificateKeyFile=path/tls.crt&tlsCAFile=path/ca.pem pbm status`

mongod logs:

```auto
"NETWORK" "msg":"Connection accepted"
"NETWORK" "msg":"Connection ended"

```

There are no corresponding ‘ACCESS’ logs.

The error reported by pbm is `Error: connect to mongodb: setup a new backups db: ensure cmd collection: (Unauthorized) command create requires authentication`

Are there any guides for mTLS connections with pbm?

---

<div class="post-metadata">

**Author:** ![tra\_for](https://avatars.discourse-cdn.com/v4/letter/t/3da27b/32.png) [@tra\_for](https://forums.percona.com/u/tra_for)\
**Post date:** [December 5, 2023, 2:33am UTC](https://forums.percona.com/t/how-to-use-pbm-agent-with-client-tls/11237/2 "2023-12-05T02:33:27Z")

</div>

I’m also seeing similar issues, pbm-agent works fine with `preferTLS` but failed when using with my requirement `requireTLS`. Somehow mongo URI is set to basic auth. the agent container command runs fine. I ran it verbosely, it does set the right URI, however, the export is not updating the environment variable on the container. I’m able to also update the env variable but not the container script. Notice the output below, variable didn’t get updated. Any help is appreciated.

agent container command  
`bash -x /opt/percona/pbm-entry.sh`

```auto
+ PBM_MONGODB_URI='mongodb://user:password@localhost:27017/?replicaSet=cfg'
+ MONGO_SSL_DIR=/etc/mongodb-ssl
+ [[-f /etc/mongodb-ssl/tls.crt]]
+ [[-f /etc/mongodb-ssl/tls.key]]
+ cat /etc/mongodb-ssl/tls.key /etc/mongodb-ssl/tls.crt
+ PBM_MONGODB_URI=mongodb://user:password@localhost:27017/?replicaSet=cfg&tls=true&tlsCertificateKeyFile=%2Ftmp%2Ftls.pem&tlsCAFile=/etc/mongodb-ssl%2Fca.crt&tlsInsecure=true'
+ export PBM_MONGODB_URI
+ exec
bash-4.4$ env | grep PBM_MONGODB_URI
PBM_MONGODB_URI=mongodb://user:password@test-cfg-2

```

---

<div class="post-metadata">

**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\
**Post date:** [December 5, 2023, 12:14pm UTC](https://forums.percona.com/t/how-to-use-pbm-agent-with-client-tls/11237/3 "2023-12-05T12:14:51Z")

</div>

Hi, try adding --authenticationDatabase ‘$external’ to your command

---

<div class="post-metadata">

**Author:** ![tra\_for](https://avatars.discourse-cdn.com/v4/letter/t/3da27b/32.png) [@tra\_for](https://forums.percona.com/u/tra_for)\
**Post date:** [December 5, 2023, 2:13pm UTC](https://forums.percona.com/t/how-to-use-pbm-agent-with-client-tls/11237/4 "2023-12-05T14:13:55Z")

</div>

Hi,  
Thanks for responding, maybe this needs a separate post. This seems to be a bug in the agent container script. it’s not setting the environment variable. I ran the script in debug mode above to see what it’s doing.

---

<div class="post-metadata">

**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\
**Post date:** [December 7, 2023, 11:27am UTC](https://forums.percona.com/t/how-to-use-pbm-agent-with-client-tls/11237/5 "2023-12-07T11:27:02Z")

</div>

Please report the bug at [jira.percona.com](http://jira.percona.com) if you get a chance!