Kerberos化的MongoDBJava连接中的证书错误

我正在尝试使用Java驱动程序连接到3节点的MongoDB副本集（启用了kerberos和ssl）。我的代码如下所示：

public class MongoDBPoC {
static {
System.setProperty("javax.net.ssl.trustStore","mongo_test.truststore");
System.setProperty("javax.net.ssl.trustStorePassword","changeit");
System.setProperty("javax.security.auth.useSubjectCredsOnly","false");
System.setProperty("java.security.auth.login.config","jaas.conf");
}
public static void main(String[] args) {
MongoClient mOngoClient= MongoClients.create(
"mongodb://username%40REALM.COM@server01.domain.com:27017/?authMechanism=GSSAPI&ssl=true");
MongoDatabase database = mongoClient.getDatabase("MY_DB");
MongoCollection collection = database.getcollection("MY_COLL");
System.out.println(collection.countDocuments());
}
}


当我尝试连接到其中一个节点（它们中的任何一个）时，我可以成功连接。但是，当我在连接字符串中提供所有节点时，连接将失败。我的意思是

mongodb://username%40REALM.COM@server01.domain.com:27017/?authMechanism=GSSAPI&ssl=true


工作正常，但是

mongodb://username%40REALM.COM@server01.domain.com:27017,server02.domain.com:27017,server03.domain.com:27017/?authMechanism=GSSAPI&ssl=true


失败，但以下情况除外：

Kas 13,2019 10:44:45 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Cluster created with settings {hosts=[server01.domain.com:27017,server03.domain.com:27017],mode=MULTIPLE,requiredClusterType=REPLICA_SET,serverSelectiOnTimeout='30000 ms',maxWaitQueueSize=500,requiredReplicaSetName='rs1'}
Kas 13,2019 10:44:45 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Adding discovered server server01.domain.com:27017 to client view of cluster
Kas 13,2019 10:44:45 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Adding discovered server server02.domain.com:27017 to client view of cluster
Kas 13,2019 10:44:45 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Adding discovered server server03.domain.com:27017 to client view of cluster
Kas 13,2019 10:44:45 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: No server chosen by com.mongodb.client.internal.MongoClientDelegate$1@3567135c from cluster description ClusterDescription{type=REPLICA_SET,cOnnectionmode=MULTIPLE,serverDescriptiOns=[ServerDescription{address=server01.domain.com:27017,type=UNKNOWN,state=CONNECTING},ServerDescription{address=server02.domain.com:27017,ServerDescription{address=server03.domain.com:27017,state=CONNECTING}]}. Waiting for 30000 ms before timing out
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Opened connection [connectionId{localValue:2,serverValue:4486}] to server02.domain.com:27017
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Opened connection [connectionId{localValue:1,serverValue:36356}] to server01.domain.com:27017
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Opened connection [connectionId{localValue:3,serverValue:4189}] to server03.domain.com:27017
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Monitor thread successfully connected to server with description ServerDescription{address=server01.domain.com:27017,type=REPLICA_SET_SECONDARY,state=CONNECTED,ok=true,version=ServerVersion{versiOnList=[4,2,0]},minWireversion=0,maxWireversion=8,maxDocumentSize=16777216,logicalSessiOnTimeoutMinutes=30,roundTripTimeNanos=25084370,setName='rs1',canOnicalAddress=server01:27017,hosts=[server03:27017,server01:27017,server02:27017],passives=[],arbiters=[],primary='server02:27017',tagSet=TagSet{[]},electiOnId=null,setVersion=5,lastWriteDate=Wed Nov 13 10:44:37 EET 2019,lastUpdateTimeNanos=1840350107661741}
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Monitor thread successfully connected to server with description ServerDescription{address=server03.domain.com:27017,roundTripTimeNanos=24081447,canOnicalAddress=server03:27017,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Monitor thread successfully connected to server with description ServerDescription{address=server02.domain.com:27017,type=REPLICA_SET_PRIMARY,roundTripTimeNanos=25093623,canOnicalAddress=server02:27017,electiOnId=7fffffff0000000000000195,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Adding discovered server server03:27017 to client view of cluster
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Adding discovered server server01:27017 to client view of cluster
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Adding discovered server server02:27017 to client view of cluster
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Canonical address server03:27017 does not match server address. Removing server03.domain.com:27017 from client view of cluster
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Server server01.domain.com:27017 is no longer a member of the replica set. Removing from client view of cluster.
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Server server02.domain.com:27017 is no longer a member of the replica set. Removing from client view of cluster.
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Canonical address server02:27017 does not match server address. Removing server02.domain.com:27017 from client view of cluster
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Exception in monitor thread while connecting to server server01:27017
com.mongodb.MongoSocketWriteException: Exception sending message
at com.mongodb.internal.connection.InternalStreamConnection.translateWriteException(InternalStreamConnection.java:541)
at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:429)
at com.mongodb.internal.connection.InternalStreamConnection.sendCommandMessage(InternalStreamConnection.java:269)
at com.mongodb.internal.connection.InternalStreamConnection.sendAndReceive(InternalStreamConnection.java:253)
at com.mongodb.internal.connection.CommandHelper.sendAndReceive(CommandHelper.java:83)
at com.mongodb.internal.connection.CommandHelper.executeCommand(CommandHelper.java:33)
at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initializeConnectionDescription(InternalStreamConnectionInitializer.java:105)
at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initialize(InternalStreamConnectionInitializer.java:62)
at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:127)
at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:117)
at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching server01 found
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1959)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:757)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
at com.mongodb.internal.connection.SocketStream.write(SocketStream.java:99)
at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:426)
... 9 more
Caused by: java.security.cert.CertificateException: No name matching server01 found
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:231)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:96)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:200)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
... 18 more
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Exception in monitor thread while connecting to server server02:27017
com.mongodb.MongoSocketWriteException: Exception sending message
at com.mongodb.internal.connection.InternalStreamConnection.translateWriteException(InternalStreamConnection.java:541)
at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:429)
at com.mongodb.internal.connection.InternalStreamConnection.sendCommandMessage(InternalStreamConnection.java:269)
at com.mongodb.internal.connection.InternalStreamConnection.sendAndReceive(InternalStreamConnection.java:253)
at com.mongodb.internal.connection.CommandHelper.sendAndReceive(CommandHelper.java:83)
at com.mongodb.internal.connection.CommandHelper.executeCommand(CommandHelper.java:33)
at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initializeConnectionDescription(InternalStreamConnectionInitializer.java:105)
at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initialize(InternalStreamConnectionInitializer.java:62)
at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:127)
at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:117)
at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching server02 found
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1959)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:757)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
at com.mongodb.internal.connection.SocketStream.write(SocketStream.java:99)
at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:426)
... 9 more
Caused by: java.security.cert.CertificateException: No name matching server02 found
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:231)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:96)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:200)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
... 18 more
Kas 13,2019 10:44:46 AM com.mongodb.diagnostics.logging.JULLogger log
INFO: Exception in monitor thread while connecting to server server03:27017
com.mongodb.MongoSocketWriteException: Exception sending message
at com.mongodb.internal.connection.InternalStreamConnection.translateWriteException(InternalStreamConnection.java:541)
at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:429)
at com.mongodb.internal.connection.InternalStreamConnection.sendCommandMessage(InternalStreamConnection.java:269)
at com.mongodb.internal.connection.InternalStreamConnection.sendAndReceive(InternalStreamConnection.java:253)
at com.mongodb.internal.connection.CommandHelper.sendAndReceive(CommandHelper.java:83)
at com.mongodb.internal.connection.CommandHelper.executeCommand(CommandHelper.java:33)
at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initializeConnectionDescription(InternalStreamConnectionInitializer.java:105)
at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initialize(InternalStreamConnectionInitializer.java:62)
at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:127)
at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:117)
at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching server03 found
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1959)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:757)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
at com.mongodb.internal.connection.SocketStream.write(SocketStream.java:99)
at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:426)
... 9 more
Caused by: java.security.cert.CertificateException: No name matching server03 found
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:231)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:96)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:200)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
... 18 more


驱动程序似乎以某种方式找到了域名server01，server02，server03，而它当然在ssl证书中找不到这些名称。它应该使用我提供的名称进行连接：server01.domain.com，server02.domain.com，server03.domain.com。驾驶员在哪里找到这些名字？我该如何纠正？

非常感谢您