数据库开启requireSSL场景下，source和tunnel认证CA正常，ckpt的CA认证失败。

[Steloj-shaw]

mongoshake版本: v2.8.7
源端数据库版本 mongodb 7.0.30
目标数据库版本 mongodb 7.0.30

配置文件信息
conf.version = 14
id = hsb_can_mgo2mgo_online2settle
master_quorum = false
full_sync.http_port = 9127
incr_sync.http_port = 9128
system_profile_port = 9130
log.dir = /mongoshake/logs/
log.file = mongoshake.log
log.flush = false
sync_mode = incr
mongo_urls = mongodb://admin:admin@poc-test-mgo01.poc.com:23636/admin
mongo_ssl_root_ca_file = /mongodb/mongodb_data/conf/rootCAcombined.pem
tunnel = direct
tunnel.address = mongodb://admin:admin@poc-test-mgo01.poc.com:23636/admin
tunnel.mongo_ssl_root_ca_file = /mongodb/mongodb_data/conf/rootCAcombined.pem
mongo_connect_mode = secondaryPreferred
checkpoint.storage.url = mongodb://admin:admin@poc-test-mgo01.poc.com:23636/admin
checkpoint.storage.db = mongoshake
checkpoint.storage.collection = hsb_can_mgo2mgo_online2settle
checkpoint.storage.url.mongo_ssl_root_ca_file = /mongodb/mongodb_data/conf/rootCAcombined.pem
checkpoint.start_position = 1970-01-01T00:00:00Z
transform.namespace = evoonline:evosettle

---

我的源端/目标端/CKPT端使用的全部都是同一个数据库 ，同一个URL，同一个用户 以及同一个CA证书。 但是源端和目标端验证都通过了，CKPT验证报错，具体日志如下:

[2026/03/17 18:25:06 CST] [INFO] log init succeed. log.dir[/mongoshake/logs/] log.name[mongoshake.log] log.level[info]
[2026/03/17 18:25:06 CST] [INFO] MongoDB Version Source[7.0.30] Target[7.0.30]
[2026/03/17 18:25:06 CST] [WARN]

---

\ \ _ ______ |
\ \ / _-=O'/|O'/|
\ MongoShake, Here we go !! _\ / | / )
/ / '/-== _/|/=-| -GM
/ Alibaba Cloud / * \ | |
/ / (o)

if you have any problem, please visit https://github.com/alibaba/MongoShake/wiki/FAQ

[2026/03/17 18:25:06 CST] [INFO] New session to mongodb://admin:@poc-test-mgo01.poc.com:23636/admin successfully
[2026/03/17 18:25:06 CST] [INFO] Close client with mongodb://admin:@poc-test-mgo01.poc.com:23636/admin
[2026/03/17 18:25:06 CST] [INFO] New session to mongodb://admin:@poc-test-mgo01.poc.com:23636/admin successfully
[2026/03/17 18:25:06 CST] [INFO] Close client with mongodb://admin:@poc-test-mgo01.poc.com:23636/admin
[2026/03/17 18:25:06 CST] [INFO] Collector startup. shard_by[collection] gids[[]]
[2026/03/17 18:25:06 CST] [INFO] Collector configuration {"ConfVersion":14,"Id":"hsb_can_mgo2mgo_online2settle","MasterQuorum":false,"FullSyncHTTPListenPort":9127,"IncrSyncHTTPListenPort":9128,"SystemProfilePort":9130,"LogLevel":"info","LogDirectory":"/mongoshake/logs/","LogFileName":"mongoshake.log","LogFlush":false,"SyncMode":"incr","MongoUrls":["mongodb://admin:@poc-test-mgo01.poc.com:23636/admin"],"MongoCsUrl":"","MongoSUrl":"","MongoSslRootCaFile":"/mongodb/mongodb_data/conf/rootCAcombined.pem","MongoSslClientCaFile":"","MongoConnectMode":"secondaryPreferred","Tunnel":"direct","TunnelAddress":["mongodb://admin:@poc-test-mgo01.poc.com:23636/admin"],"TunnelMessage":"raw","TunnelKafkaPartitionNumber":1,"TunnelKafkaSaslEnable":false,"TunnelKafkaSaslAuth":"","TunnelKafkaSaslMechanism":"","TunnelKafkaCompression":"","KafkaProducerMaxMessage":0,"TunnelJsonFormat":"","TunnelMongoSslRootCaFile":"/mongodb/mongodb_data/conf/rootCAcombined.pem","FilterNamespaceBlack":null,"FilterNamespaceWhite":["^evoonline.evo.trans$","^evoonline.evo.token.cryptogram$","^evoonline.evo.instalment$","^evoonline.evo.recurringRecord$","^evoonline.evo.token.apply$","^evoonline.evo.trans.retry$","^evoonline.evo.trans.batchSettle$","^evoonline.evo.order$"],"FilterPassSpecialDb":null,"FilterDDLEnable":false,"FilterOplogGids":false,"CheckpointStorageUrl":"mongodb://admin:@poc-test-mgo01.poc.com:23636/admin","CheckpointStorageDb":"mongoshake","CheckpointStorageCollection":"hsb_can_mgo2mgo_online2settle","CheckpointStorageUrlMongoSslRootCaFile":"/mongodb/mongodb_data/conf/rootCAcombined.pem","CheckpointStartPosition":1,"TransformNamespace":["evoonline:evosettle"],"SpecialSourceDBFlag":"","SkipNSShareKeyVerify":null,"FullSyncReaderCollectionParallel":6,"FullSyncReaderWriteDocumentParallel":8,"FullSyncReaderDocumentBatchSize":128,"FullSyncReaderFetchBatchSize":1024,"FullSyncReaderParallelThread":1,"FullSyncReaderParallelIndex":"_id","FullSyncReaderSplitMaxChunkSize":1024,"FullSyncCollectionDrop":false,"FullSyncCreateIndex":"background","FullSyncReaderOplogStoreDisk":false,"FullSyncReaderOplogStoreDiskMaxSize":256000,"FullSyncExecutorInsertOnDupUpdate":false,"FullSyncExecutorFilterOrphanDocument":false,"FullSyncExecutorMajorityEnable":false,"FullSyncDoNotShardDest":false,"IncrSyncMongoFetchMethod":"change_stream","IncrSyncChangeStreamWatchFullDocument":false,"IncrSyncReaderFetchBatchSize":1024,"IncrSyncOplogGIDS":null,"IncrSyncShardKey":"collection","IncrSyncShardByObjectIdWhiteList":null,"IncrSyncWorker":2,"IncrSyncTunnelWriteThread":2,"IncrSyncTargetDelay":0,"IncrSyncWorkerBatchQueueSize":4,"IncrSyncAdaptiveBatchingMaxSize":8,"IncrSyncFetcherBufferCapacity":4,"IncrSyncFetcherBufferSizeThresholdInKB":128,"IncrSyncExecutorUpsert":false,"IncrSyncExecutorInsertOnDupUpdate":false,"IncrSyncConflictWriteTo":"none","IncrSyncExecutorMajorityEnable":false,"IncrSyncBypassDocumentValidation":false,"CheckpointStorage":"database","CheckpointInterval":5000,"FullSyncExecutorDebug":false,"IncrSyncDBRef":false,"IncrSyncExecutor":1,"IncrSyncExecutorDebug":false,"IncrSyncReaderDebug":"","IncrSyncCollisionEnable":false,"IncrSyncReaderBufferTime":1,"IncrSyncWorkerOplogCompressor":"none","IncrSyncTunnelKafkaDebug":"","Version":"develop,a484d2166bff2a37f798c31175823a56bddf395c,release,go1.24.5,2025-12-18_14:42:30","SourceDBVersion":"7.0.30","TargetDBVersion":"7.0.30","IncrSyncTunnel":"","IncrSyncTunnelAddress":null,"IncrSyncTunnelMessage":"","HTTPListenPort":0,"SystemProfile":0}
[2026/03/17 18:25:06 CST] [INFO] New session to mongodb://admin:@poc-test-mgo01.poc.com:23636/admin successfully
[2026/03/17 18:25:06 CST] [INFO] Close client with mongodb://admin:@poc-test-mgo01.poc.com:23636/admin
[2026/03/17 18:25:06 CST] [INFO] New session to mongodb://admin:@poc-test-mgo01.poc.com:23636/admin successfully
[2026/03/17 18:25:06 CST] [INFO] Close client with mongodb://admin:@poc-test-mgo01.poc.com:23636/admin
[2026/03/17 18:25:06 CST] [INFO] GetAllTimestamp biggestNew:{1773743102 1}, smallestNew:{1773743102 1}, biggestOld:{1773740401 1}, smallestOld:{1773740401 1}, MongoSource:[url[mongodb://admin:@poc-test-mgo01.poc.com:23636/admin], name[poc]], tsMap:map[poc:{7618157013888925697 7618168614595592193}]
[2026/03/17 18:25:06 CST] [INFO] all node timestamp map: map[poc:{7618157013888925697 7618168614595592193}] CheckpointStartPosition:{1 0}
select sync mode failed: get mongod[poc] checkpoint failed: get by checkpoint info from db or api failed, please see err log
[2026/03/17 18:25:36 CST] [EROR] poc MongoCheckpoint create client failed:ping to mongodb://admin:***@poc-test-mgo01.poc.com:23636/admin failed: server selection error: server selection timeout, current topology: { Type: Unknown, Servers: [{ Addr: poc-test-mgo01.poc.com:23636, Type: Unknown, Last error: connection(poc-test-mgo01.poc.com:23636[-85]) socket was unexpectedly closed: EOF: connection(poc-test-mgo01.poc.com:23636[-85]) socket was unexpectedly closed: EOF }, ] }
If mongo server is standalone(single node) or conn address is different with mongo server address try a standalone mode by mongodb://ip:port/admin?directConnection=true
[2026/03/17 18:25:36 CST] [EROR] poc MongoCheckpoint ensureNetwork failed
[2026/03/17 18:25:36 CST] [CRIT] run replication failed: select sync mode failed: get mongod[poc] checkpoint failed: get by checkpoint info from db or api failed, please see err log
[2026/03/17 18:25:36 CST] [WARN]
##### | #####
Oh we finish ? # _ _ #|# _ _ #
# | #
| ############
# #
| # #
# #
| | # # | |
| | # # |
| | | # .-. # |
#( O )# | | |
| ################. .############### |

_ |__| ### | __| _

| |

| | | | | | | |

######################################
# #
#####

[18:25:36 CST 2026/03/17] [CRIT] (main.startup:152) run replication failed: select sync mode failed: get mongod[poc] checkpoint failed: get by checkpoint info from db or api failed, please see err log

抱歉打扰 。 @zhongli-james

[Steloj-shaw]

补充 数据库日志：
{"t":{"$date":"2026-03-17T18:50:05.818+08:00"},"s":"I", "c":"NETWORK", "id":22943, "ctx":"listener","msg":"Connection accepted","attr":{"remote":"192.168.1.221:33270","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"07f0d3ae-b738-4cfb-8342-654a066bc0c0"}},"connectionId":273,"connectionCount":22}}
{"t":{"$date":"2026-03-17T18:50:05.819+08:00"},"s":"I", "c":"EXECUTOR", "id":22988, "ctx":"conn273","msg":"Error receiving request from client. Ending connection from remote","attr":{"error":{"code":141,"codeName":"SSLHandshakeFailed","errmsg":"The server is configured to only allow SSL connections"},"remote":"192.168.1.221:33270","connectionId":273}}
{"t":{"$date":"2026-03-17T18:50:05.819+08:00"},"s":"I", "c":"NETWORK", "id":22944, "ctx":"conn273","msg":"Connection ended","attr":{"remote":"192.168.1.221:33270","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"07f0d3ae-b738-4cfb-8342-654a066bc0c0"}},"connectionId":273,"connectionCount":21}}
{"t":{"$date":"2026-03-17T18:50:06.318+08:00"},"s":"I", "c":"NETWORK", "id":22943, "ctx":"listener","msg":"Connection accepted","attr":{"remote":"192.168.1.221:33278","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"f1cea189-ab35-4e3d-8ce9-0b893fb6133e"}},"connectionId":274,"connectionCount":22}}
{"t":{"$date":"2026-03-17T18:50:06.318+08:00"},"s":"I", "c":"EXECUTOR", "id":22988, "ctx":"conn274","msg":"Error receiving request from client. Ending connection from remote","attr":{"error":{"code":141,"codeName":"SSLHandshakeFailed","errmsg":"The server is configured to only allow SSL connections"},"remote":"192.168.1.221:33278","connectionId":274}}
{"t":{"$date":"2026-03-17T18:50:06.319+08:00"},"s":"I", "c":"NETWORK", "id":22944, "ctx":"conn274","msg":"Connection ended","attr":{"remote":"192.168.1.221:33278","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"f1cea189-ab35-4e3d-8ce9-0b893fb6133e"}},"connectionId":274,"connectionCount":21}}
{"t":{"$date":"2026-03-17T18:50:06.818+08:00"},"s":"I", "c":"NETWORK", "id":22943, "ctx":"listener","msg":"Connection accepted","attr":{"remote":"192.168.1.221:1798","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"ab184702-11b2-450b-b04d-7bb5d222f077"}},"connectionId":275,"connectionCount":22}}
{"t":{"$date":"2026-03-17T18:50:06.818+08:00"},"s":"I", "c":"EXECUTOR", "id":22988, "ctx":"conn275","msg":"Error receiving request from client. Ending connection from remote","attr":{"error":{"code":141,"codeName":"SSLHandshakeFailed","errmsg":"The server is configured to only allow SSL connections"},"remote":"192.168.1.221:1798","connectionId":275}}
{"t":{"$date":"2026-03-17T18:50:06.819+08:00"},"s":"I", "c":"NETWORK", "id":22944, "ctx":"conn275","msg":"Connection ended","attr":{"remote":"192.168.1.221:1798","isLoadBalanced":false,"uuid":{"uuid":{"$uuid":"ab184702-11b2-450b-b04d-7bb5d222f077"}},"connectionId":275,"connectionCount":21}}

[zhongli-james]

get，我尽快看一下。晚点同步进展

[zhongli-james]

的确是一个bug，在ensureNetwork()中，为了解决MongoDB3.6-版本不支持{readConcern:majority}的问题，会先尝试连接MongoDB实例并获取dbVersion，在这个建连的调用里忘了指定conf.Options.CheckpointStorageUrlMongoSslRootCaFile作为sslRootFile。
感谢反馈，目前单元测试里和集成测试里对这个ssl的分支都没有覆盖，我后续补充下。

[zhongli-james]

预计下个版本发布，其他人如果遇到相似问题可以在本issue里回复。我视情况决定是否尽快发布修复版本。