MongoDB v4.4

Configuring Your MongoDB v4.4 Server for Mutual TLS

How to use TLS, client authentication, and CA certificates in MongoDB v4.4

Create a private key and request a certificate for your MongoDB v4.4 server

Before you can teach your server to speak TLS, you will need a certificate issued by a trusted certificate authority (CA). If your organization already runs its own CA and you have a private key and certificate for your MongoDB v4.4 server, along with your CA's root certificate, you can skip to the next step.

To request a certificate from your CA using the step CLI, bootstrap your CA with step ca bootstrap and run the following command (sub the server name for the actual name / DNS name of your MongoDB v4.4 server).

$ step ca certificate "myserver.internal.net" server.crt server.key

Your certificate and private key will be saved in server.crt and server.key respectively.

Request a copy of your CA root certificate, which will be used to make sure each application can trust certificates presented by other applications.

$ step ca root ca.crt

Your certificate will be saved in ca.crt.

Configure MongoDB v4.4 to authenticate itself with its TLS certificate

We now want to instruct our MongoDB v4.4 server to identify itself using the certificate issued in the last step and to force clients to connect over TLS.

Copy the server.crt, server.key, and ca.crt files to /etc/step/certs/.

$ sudo cat server.crt server.key > /etc/step/certs/mongod.pem $ sudo cp ca.crt /etc/step/certs/ca.pem $ sudo chown mongodb:mongodb /etc/step/certs/mongod.pem /etc/step/certs/ca.pem

Now you'll need to configure your /etc/mongodb.conf to use server authentication.

net: tls: mode: requireTLS certificateKeyFile: /etc/step/certs/mongod.pem

Restart your mongoDB server for these changes to take effect. Confirm the configuration by connecting with a mongoDB client:

$ mongo --tls --tlsCAFile /etc/step/certs/ca.crt MongoDB shell version v4.4.3 connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb Implicit session: session { "id" : UUID("5ddf6126-1b99-4364-a2c5-4262ad2e9d7b") } MongoDB server version: 4.4.3 Welcome to the MongoDB shell. ...

Improve this content

Read more

Configure MongoDB v4.4 to require clients to authenticate with a certificate issued by your CA

To tell MongoDB v4.4 to use mutual TLS and not just one-way TLS, we must instruct it to require client authentication to ensure clients present a certificate from our CA when they connect.

Copy the server.crt, server.key, and ca.crt files to /etc/step/certs/.

$ sudo cat server.crt server.key > /etc/step/certs/mongod.pem $ sudo cp ca.crt /etc/step/certs/ca.pem

Now you'll need to configure your /etc/mongodb.conf to enforce client authentication.

net: tls: mode: requireTLS certificateKeyFile: /etc/step/certs/mongod.pem CAFile: /etc/step/certs/ca.pem

Restart your mongoDB server for these changes to take effect. Confirm the configuration by connecting with a mongoDB client:

$ cat client.crt client.key > client.pem $ mongo --tls --tlsCAFile ca.crt --tlsCertificateKeyFile client.pem MongoDB shell version v4.4.3 connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb Implicit session: session { "id" : UUID("5ddf6126-1b99-4364-a2c5-4262ad2e9d7b") } MongoDB server version: 4.4.3 Welcome to the MongoDB shell. ...

That's it! MongoDB v4.4 should now be able to receive TLS connections from clients who authenticate themselves using a certificate issued by your trusted CA.

Automate certificate renewal

By default, step-ca issues certificates with a 24 hour expiration. Short-lived certificates have many benefits but also require that you renew your certificates each day before they expire. How you renew certificates is often dependent on how you deploy your application. See the step-ca certificate lifecycle management docs for more information.

All documentation content from the Hello mTLS project is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).

Creative Commons License

Connect to Your MongoDB v4.4 Server from a Client

Subscribe
Subscribe to updates

Unsubscribe anytime. See our privacy policy.