# PBM connection error with TLS bad OCSP signature: crypto/rsa: verification error

**URL:** <https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741>\
**Category:** Percona Backup for MongoDB\
**Tags:** percona, mongodb, pbm\
**Created:** [August 30, 2024, 10:10am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741 "2024-08-30T10:10:58Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shashank\_BS](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shashank\_BS](https://forums.percona.com/u/Shashank_BS)\
**Post date:** [August 30, 2024, 10:10am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/1 "2024-08-30T10:10:58Z")

</div>

Hi,

I have single Mongodb deployed in replica set and I have setup Percona MongoDB with TLS/SSL certificate for encryption in transit.

 ![Screenshot 2024-08-30 152831](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/2/d/2d72c5d8c46718b6d207932f2ffd201bee829899.png)

My nodejs application is successfully able to connect to Mongodb without any issue, however I’m facing trouble connecting PBM-Agent with MongoDB. If I run pbm status or check pbm-agent status with systemctl status pbm-agent.service I get following error.

pbm status  
Error: connect to mongodb: create mongo connection: ping: server selection error: server selection timeout, current topology: { Type: ReplicaSetNoPrimary, Servers: [{ Addr: [domainname.com:27017](http://domainname.com:27017), Type: Unknown, Last error: error parsing stapled response: bad OCSP signature: crypto/rsa: verification error }, ] }

Connection String: export PBM\_MONGODB\_URI=“mongodb://pmm:password@domainname.com:27017/admin?authSource=admin&replicaSet=rs0&tls=true&tlsCAFile=/imsdevdata/certificates/domainname.ca.pem&tlsCertificateKeyFile=/imsdevdata/certificates/mongod.pem”

rs.status gives following result in members:  
members: [  
{  
\_id: 0,  
name: ‘[domainname.com:27017](http://domainname.com:27017)’,  
health: 1,  
state: 1,  
stateStr: ‘PRIMARY’,  
etc…  
}]

Note: I’m using CA signed certificate.

Please help…

---

<div class="post-metadata">

**Author:** ![oleksandr.havryliak](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/oleksandr.havryliak/32/5703_2.png) [@oleksandr.havryliak](https://forums.percona.com/u/oleksandr.havryliak)\
**Post date:** [September 10, 2024, 6:40am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/2 "2024-09-10T06:40:57Z")

</div>

Hi @Shashank_BS !  
Look’s like you have an issue with connection to OCSP responder, you can disable OSCP verification by adding the option `tlsDisableOCSPEndpointCheck=true` to PBM\_MONGODB\_URI

---

<div class="post-metadata">

**Author:** ![Shashank\_BS](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shashank\_BS](https://forums.percona.com/u/Shashank_BS)\
**Post date:** [September 10, 2024, 6:58am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/3 "2024-09-10T06:58:13Z")

</div>

Hi @oleksandr.havryliak thanks for your reply. I modified the PBM\_MONGODB\_URI value in /etc/sysconfig/pbm-agent to include tlsDisableOCSPEndpointCheck=true

PBM\_MONGODB\_URI=“mongodb://pmm:@domainname.com:27017/?authSource=admin&replSetName=rs0&tls=true&tlsCAFile=/imsdevdata/certificates/ca.pem&tlsCertificateKeyFile=/imsdevdata/certificates/mongod.pem&directConnect=true&tlsDisableOCSPEndpointCheck=true”

But still pbm is unable to connect to the database.

systemctl status pbm-agent  
Loaded: loaded (/usr/lib/systemd/system/pbm-agent.service; enabled; vendor preset: disabled)  
Active: failed (Result: exit-code) since Tue 2024-09-10 06:57:02 GMT; 1s ago  
Process: 2925598 ExecStart=/usr/bin/pbm-agent (code=exited, status=1/FAILURE)  
Main PID: 2925598 (code=exited, status=1/FAILURE)

Sep 10 06:56:32 hilimsdevdb01 systemd[1]: Started pbm-agent.  
Sep 10 06:57:02 hilimsdevdb01 pbm-agent[2925598]: 2024/09/10 06:57:02 Exit: connect to PBM: create mongo connection: ping: server selection error: server selection timeout, current topology: { Type: Unknown, Servers: [{ Addr: [domainname.com:27017](http://domainname.com:27017), Type: Unknown, Last error: error parsing stapled response: bad OCSP signature: crypto/rsa: verification error }, ] }  
Sep 10 06:57:02 hilimsdevdb01 systemd[1]: pbm-agent.service: Main process exited, code=exited, status=1/FAILURE  
Sep 10 06:57:02 hilimsdevdb01 systemd[1]: pbm-agent.service: Failed with result ‘exit-code’.

---

<div class="post-metadata">

**Author:** ![oleksandr.havryliak](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/oleksandr.havryliak/32/5703_2.png) [@oleksandr.havryliak](https://forums.percona.com/u/oleksandr.havryliak)\
**Post date:** [September 10, 2024, 7:43am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/4 "2024-09-10T07:43:47Z")

</div>

I’m curious that you are using the same pem file for both the server and the client. Can you try removing the `tlsCertificateKeyFile` parameter from the connection string?

---

<div class="post-metadata">

**Author:** ![oleksandr.havryliak](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/oleksandr.havryliak/32/5703_2.png) [@oleksandr.havryliak](https://forums.percona.com/u/oleksandr.havryliak)\
**Post date:** [September 10, 2024, 8:19am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/5 "2024-09-10T08:19:39Z")

</div>

And could you, please, check the output of

```auto
openssl x509 -in /imsdevdata/certificates/mongod.pem -text -noout | grep -A2 'Authority Information Access'

```

You should see something like

```auto
            Authority Information Access: 
                OCSP - URI:http://o.pki.goog/wr2
                CA Issuers - URI:http://i.pki.goog/wr2.crt

```

You can check the accessibility of OCSP URI from the host where PBM is installed

---

<div class="post-metadata">

**Author:** ![Shashank\_BS](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shashank\_BS](https://forums.percona.com/u/Shashank_BS)\
**Post date:** [September 10, 2024, 8:28am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/6 "2024-09-10T08:28:11Z")

</div>

Yes you are correct I’m using same mongod.pem file for both Server and Client. Our customer provided us with only one CA signed SSL certificate to use for both Client and Server.

I tried to connect to mongodb by removing tlsCertificateKeyFile parameter still getting same error.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/a/8/a8874e8a570ada5672b364595343ab9c3926aee4.png)

---

<div class="post-metadata">

**Author:** ![oleksandr.havryliak](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/oleksandr.havryliak/32/5703_2.png) [@oleksandr.havryliak](https://forums.percona.com/u/oleksandr.havryliak)\
**Post date:** [September 10, 2024, 8:45am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/7 "2024-09-10T08:45:08Z")

</div>

You can try disabling `ocsp stapling` by disable OCSP on the mongodb side - add

```auto
setParameter:
  ocspEnabled: false

```

to your mongod.conf and restart mongodb

---

<div class="post-metadata">

**Author:** ![Shashank\_BS](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shashank\_BS](https://forums.percona.com/u/Shashank_BS)\
**Post date:** [September 10, 2024, 8:50am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/8 "2024-09-10T08:50:41Z")

</div>

Yes, pbm is able to connect to mongodb when I disable ocsp stapling on Mongodb side.  
I just don’t understand why pbm is unable to connect to mongodb and failing with ocsp validation but our nodejs application is able to connect to mongodb with same connection string.

What am I missing here? Is it an issue with pbm or go driver I really don’t get it.

---

<div class="post-metadata">

**Author:** ![oleksandr.havryliak](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/oleksandr.havryliak/32/5703_2.png) [@oleksandr.havryliak](https://forums.percona.com/u/oleksandr.havryliak)\
**Post date:** [September 10, 2024, 9:02am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/9 "2024-09-10T09:02:58Z")

</div>

I think that ocsp is not fully implemented for nodejs driver but it works for go-driver. In your case you might have some issues with connection to ocsp responder.

---

<div class="post-metadata">

**Author:** ![Shashank\_BS](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shashank\_BS](https://forums.percona.com/u/Shashank_BS)\
**Post date:** [September 10, 2024, 9:08am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/10 "2024-09-10T09:08:48Z")

</div>

We also checked this issue with the SSL provider they said there is no issue with certificate and ocsp verification . Mind if I ask you whether go driver uses openssl to verify the certificate or it uses any other methods asking because with openssl I was able to verify the stapling of the certificate from the same server where pbm is installed.

---

<div class="post-metadata">

**Author:** ![oleksandr.havryliak](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/oleksandr.havryliak/32/5703_2.png) [@oleksandr.havryliak](https://forums.percona.com/u/oleksandr.havryliak)\
**Post date:** [September 10, 2024, 9:39am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/11 "2024-09-10T09:39:00Z")

</div>

One small question: could you, please, provide us with your Operating System version and Mongodb version?

---

<div class="post-metadata">

**Author:** ![Shashank\_BS](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shashank\_BS](https://forums.percona.com/u/Shashank_BS)\
**Post date:** [September 10, 2024, 9:48am UTC](https://forums.percona.com/t/pbm-connection-error-with-tls-bad-ocsp-signature-crypto-rsa-verification-error/32741/12 "2024-09-10T09:48:55Z")

</div>

We are currently using Oracle Linux 8.  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/b/b/bb4ca8a2710c1b5e58f94716ff548eb07675bb6f.png)

Mongodb version 6.0.15  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/9/6/96680d2f0971faa43fb2ce72cba8bc91688e62fb.png)

Pbm-agent version 2.5.0  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/d/0/d054a480fd1bf76d6df5689fe3eb8682ea117a51.png)