Configuring Your MongoDB v4.4 Server for Mutual TLS
How to use TLS, client authentication, and CA certificates in MongoDB v4.4
Create a private key and request a certificate for your MongoDB v4.4 server
Before you can teach your server to speak TLS, you will need a certificate issued by a trusted certificate authority (CA). If your organization already runs its own CA and you have a private key and certificate for your MongoDB v4.4 server, along with your CA's root certificate, you can skip to the next step.
To request a certificate from your CA using the step CLI, bootstrap your CA with step ca bootstrap and run the following command (sub the server name for the actual name / DNS name of your MongoDB v4.4 server).
$ step ca certificate "myserver.internal.net" server.crt server.keyYour certificate and private key will be saved in server.crt and server.key respectively.
Request a copy of your CA root certificate, which will be used to make sure each application can trust certificates presented by other applications.
$ step ca root ca.crtYour certificate will be saved in ca.crt.
Configure MongoDB v4.4 to authenticate itself with its TLS certificate
We now want to instruct our MongoDB v4.4 server to identify itself using the certificate issued in the last step and to force clients to connect over TLS.
Copy the server.crt, server.key, and ca.crt files to /etc/step/certs/.
$ sudo cat server.crt server.key > /etc/step/certs/mongod.pem
$ sudo cp ca.crt /etc/step/certs/ca.pem
$ sudo chown mongodb:mongodb /etc/step/certs/mongod.pem /etc/step/certs/ca.pemNow you'll need to configure your /etc/mongodb.conf to use server authentication.
net:
tls:
mode: requireTLS
certificateKeyFile: /etc/step/certs/mongod.pemRestart your mongoDB server for these changes to take effect. Confirm the configuration by connecting with a mongoDB client:
$ mongo --tls --tlsCAFile /etc/step/certs/ca.crt
MongoDB shell version v4.4.3
connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("5ddf6126-1b99-4364-a2c5-4262ad2e9d7b") }
MongoDB server version: 4.4.3
Welcome to the MongoDB shell.
...Configure MongoDB v4.4 to require clients to authenticate with a certificate issued by your CA
To tell MongoDB v4.4 to use mutual TLS and not just one-way TLS, we must instruct it to require client authentication to ensure clients present a certificate from our CA when they connect.
Copy the server.crt, server.key, and ca.crt files to /etc/step/certs/.
$ sudo cat server.crt server.key > /etc/step/certs/mongod.pem
$ sudo cp ca.crt /etc/step/certs/ca.pemNow you'll need to configure your /etc/mongodb.conf to enforce client authentication.
net:
tls:
mode: requireTLS
certificateKeyFile: /etc/step/certs/mongod.pem
CAFile: /etc/step/certs/ca.pemRestart your mongoDB server for these changes to take effect. Confirm the configuration by connecting with a mongoDB client:
$ cat client.crt client.key > client.pem
$ mongo --tls --tlsCAFile ca.crt --tlsCertificateKeyFile client.pem
MongoDB shell version v4.4.3
connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("5ddf6126-1b99-4364-a2c5-4262ad2e9d7b") }
MongoDB server version: 4.4.3
Welcome to the MongoDB shell.
...That's it! MongoDB v4.4 should now be able to receive TLS connections from clients who authenticate themselves using a certificate issued by your trusted CA.
Automate certificate renewal
By default, step-ca issues certificates with a 24 hour expiration. Short-lived certificates have many benefits but also require that you renew your certificates each day before they expire. How you renew certificates is often dependent on how you deploy your application. See the step-ca certificate lifecycle management docs for more information.
All documentation content from the Hello mTLS project is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Connect to Your MongoDB v4.4 Server from a Client
Subscribe to updates
Unsubscribe anytime. See our privacy policy.
© 2024 Smallstep Labs, Inc. All rights reserved.