使用MongoEngine连接加密的mongod服务端

mongoengine是基于pymongo的

部分参数可以参考pymongo的文档

在mongoengine.connect中

可以使用kwargs传递参数

kwargs – allow ad-hoc parameters to be passed into the pymongo driver

ssl配置

ssl_config = {
    'ssl': True,
    'ssl_certfile': 'c1.crt',
    'ssl_keyfile': 'c1.key',
    'ssl_cert_reqs': ssl.CERT_REQUIRED,
    'ssl_ca_certs': 'ca.crt',
    'ssl_match_hostname': False
}

这里把ssl_match_hostname设置为False不检查证书的CN

避免可能的错误

raise ConnectionError("Cannot connect to database %s :\n%s" % (alias, e))
mongoengine.connection.ConnectionError: Cannot connect to database default :
hostname '192.168.1.1' doesn't match 'server'

如果颁发证书的时候CN与连接的host一致可以不设置此项

连接

connect('testdb1',
        username='testdb1u1',
        password='xyz123',
        host='192.168.1.1',
        port=27017,
        **ssl_config)

参考

http://docs.mongoengine.org/apireference.html#connecting

http://api.mongodb.com/python/current/examples/tls.html#tls-ssl-and-pymongo

http://api.mongodb.com/python/current/api/pymongo/mongo_client.html#pymongo.mongo_client.MongoClient

http://stackoverflow.com/questions/38123843/how-to-connect-to-the-mongodb-cluster-using-mongoengine/38181352

https://docs.python.org/2/library/ssl.html#ssl.SSLContext.check_hostname