Configure mongod and mongos for TLS/SSL为TLS/SSL配置mongod和mongos

Certificate Authorities证书颁发机构

For production use, your MongoDB deployment should use valid certificates generated and signed by a certificate authority. 对于生产使用，MongoDB部署应使用由证书颁发机构生成和签名的有效证书。You or your organization can generate and maintain an independent certificate authority, or use certificates generated by third-party TLS vendors. 您或您的组织可以生成和维护独立的证书颁发机构，或者使用第三方TLS供应商生成的证书。Obtaining and managing certificates is beyond the scope of this documentation.获取和管理证书超出了本文档的范围。

mongod and mongos Certificate Key File

When establishing a TLS/SSL connection, the mongod/mongos presents a certificate key file to its clients to establish its identity. [1] The certificate key file contains a public key certificate and its associated private key, but only the public component is revealed to the client.

MongoDB can use any valid TLS/SSL certificate issued by a certificate authority, or a self-signed certificate. MongoDB可以使用证书颁发机构颁发的任何有效TLS/SSL证书或自签名证书。If you use a self-signed certificate, although the communications channel will be encrypted to prevent eavesdropping on the connection, there will be no validation of server identity. 如果使用自签名证书，尽管通信信道将被加密以防止窃听连接，但不会验证服务器身份。This leaves you vulnerable to a man-in-the-middle attack. 这会让你容易受到中间人的攻击。Using a certificate signed by a trusted certificate authority will permit MongoDB drivers to verify the server's identity.使用由可信证书颁发机构签名的证书将允许MongoDB驱动程序验证服务器的身份。

In general, avoid using self-signed certificates unless the network is trusted.通常，除非网络是可信的，否则避免使用自签名证书。

With regards to certificates for replica set and sharded cluster members, it is advisable to use different certificates on different servers. 关于副本集和分片集群成员的证书，建议在不同的服务器上使用不同的证书。This minimizes exposure of the private key and allows for hostname validation.这最大限度地减少了私钥的暴露，并允许主机名验证。

Set Up mongod and mongos with TLS/SSL Certificate and Key

The following section configures mongod/mongos to use TLS/SSL connections. With these TLS/SSL settings, mongod/mongos presents its certificate key file to the client. However, the mongod/mongos does not require a certificate key file from the client to verify the client's identity. To require client's certificate key file, see Set Up mongod and mongos with Client Certificate Validation instead.

To use TLS/SSL connections, include the following TLS/SSL settings in your mongod/mongos instance's configuration file:

net:
   tls:
      mode: requireTLS
      certificateKeyFile: /etc/ssl/mongodb.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

net:
   tls:
      mode: requireTLS
      certificateSelector: subject="<CertificateCommonName>"
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

A mongod instance that uses the above configuration can only use TLS/SSL connections:

mongod --config <path/to/configuration/file>

That is, clients must specify TLS/SSL connections. See Connect to MongoDB Instance Using Encryption (tls Options) for more information on connecting with TLS/SSL.

Set Up mongod and mongos with Client Certificate Validation

The following section configures mongod/mongos to use TLS/SSL connections and perform client certificate validation. With these TLS/SSL settings:

• mongod/mongos presents its certificate key file to the client for verification.
• mongod/mongos requires a certificate key file from the client to verify the client's identity.

To use TLS/SSL connections and perform client certificate validation, include the following TLS/SSL settings in your mongod/mongos instance's configuration file:

For example, consider the following configuration file for a mongod instance:

net:
   tls:
      mode: requireTLS
      certificateKeyFile: /etc/ssl/mongodb.pem
      CAFile: /etc/ssl/caToValidateClientCertificates.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

A mongod instance that uses the above configuration can only use TLS/SSL connections and requires valid certificate from its clients:

mongod --config <path/to/configuration/file>

That is, clients must specify TLS/SSL connections and presents its certificate key file to the instance. See Connect to MongoDB Instance that Requires Client Certificates (tls Options) for more information on connecting with TLS/SSL.

net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/caToValidateClientCertificates.pem
    allowConnectionsWithoutCertificates: true

Disallow Protocols

To prevent MongoDB servers from accepting incoming connections that use specific protocols, include net.tls.disabledProtocols set to the disallowed protocols.

For example, the following configuration prevents mongod/mongos from accepting incoming connections that use either TLS1_0 or TLS1_1

net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/caToValidateClientCertificates.pem
    disabledProtocols: TLS1_0,TLS1_1

TLS/SSL Certificate Passphrase

If the certificate key files for mongod/mongos are encrypted, include net.tls.certificateKeyFilePassword set to the passphrase.

Online Certificate Rotation

Starting in MongoDB 5.0, you can rotate the following certificate key files on-demand:

• TLS Certificates
• CRL (Certificate Revocation List) files(on Linux and Windows platforms)
• CA (Certificate Authority) files

To rotate one or more of these certificates:

1. Replace the certificate or certificates you wish to rotate on the filesystem, noting the following constraints:

   • Each new certificate must have the same filename and same filepath as the certificate it is replacing.
   • If rotating an encrypted TLS Certificate, its password must be the same as the password for the old certificate (as specified to the certificateKeyFilePassword configuration file setting). Certificate rotation does not support the interactive password prompt.
2. Connect mongosh to the mongod or mongos instance that you wish to perform certificate rotation on.
3. Run the rotateCertificates command or the db.rotateCertificates() shell method to rotate the certificates used by the the mongod or mongos instance.

When certificate rotation takes place:

• Existing connections to the mongod or mongos instance are not terminated, and will continue to use the old certificates.
• Any new connections will use the new certificates.

Incorrect, expired, revoked, or missing certificate files will cause the certificate rotation to fail, but will not invalidate the existing TLS configuration or terminate the running mongod or mongos process.

Previous to MongoDB 5.0, certificate rotation required downtime, and was typically performed during maintenance windows.

See rotateCertificates or db.rotateCertificates() for additional considerations and full usage instructions.

Run in FIPS Mode

See Configure MongoDB for FIPS for more details.

Next Steps

To configure TLS/SSL support for clients, see TLS/SSL Configuration for Clients.

Set Up mongod and mongos with TLS/SSL Certificate and Key

The following section configures mongod/mongos to use TLS/SSL connections. With these TLS/SSL settings, mongod/mongos presents its certificate key file to the client. However, the mongod/mongos does not require a certificate key file from the client to verify the client's identity. To require client's certificate key file, see Set Up mongod and mongos with Client Certificate Validation instead.

To use TLS/SSL connections, include the following TLS/SSL settings in your mongod/mongos instance's configuration file:

net:
   ssl:
      mode: requireSSL
      PEMKeyFile: /etc/ssl/mongodb.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

net:
   ssl:
      mode: requireSSL
      certificateSelector: subject="<CertificateCommonName>"
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

A mongod instance that uses the above configuration can only use TLS/SSL connections:

mongod --config <path/to/configuration/file>

That is, clients must specify TLS/SSL connections. See Connect to MongoDB Instance Using Encryption (--ssl Options) for more information on connecting with TLS/SSL.

Set Up mongod and mongos with Client Certificate Validation

The following section configures mongod/mongos to use TLS/SSL connections and perform client certificate validation. With these TLS/SSL settings:

• mongod/mongos presents its certificate key file to the client for verification.
• mongod/mongos requires a certificate key file from the client to verify the client's identity.

To use TLS/SSL connections, include the following TLS/SSL settings in your mongod/mongos instance's configuration file:

For example, consider the following configuration file for a mongod instance:

net:
   ssl:
      mode: requireSSL
      PEMKeyFile: /etc/ssl/mongodb.pem
      CAFile: /etc/ssl/caToValidateClientCertificates.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

A mongod instance that uses the above configuration can only use TLS/SSL connections and requires valid certificate from its clients:

mongod --config <path/to/configuration/file>

That is, clients must specify TLS/SSL connections and presents its certificate key file to the instance. See Connect to MongoDB Instance that Requires Client Certificates (ssl Options) for more information on connecting with TLS/SSL.

net:
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/caToValidateClientCertificates.pem
    allowConnectionsWithoutCertificates: true

Disallow Protocols

To prevent MongoDB servers from accepting incoming connections that use specific protocols, include net.ssl.disabledProtocols set to the disallowed protocols.

For example, the following configuration prevents mongod/mongos from accepting incoming connections that use either TLS1_0 or TLS1_1

net:
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/caToValidateClientCertificates.pem
    disabledProtocols: TLS1_0,TLS1_1

TLS/SSL Certificate Passphrase

If the certificate key files for mongod/mongos are encrypted, include net.ssl.PEMKeyPassword set to the passphrase.

Run in FIPS Mode

See Configure MongoDB for FIPS for more details.

Next Steps

To configure TLS/SSL support for clients, see TLS/SSL Configuration for Clients.