db.rotateCertificates()

Definition定义

db.rotateCertificates(message)

Rotates the currently used TLS certificates for a mongod or mongos to use the updated values for these certificates defined in the configuration file.旋转mongod或mongos当前使用的TLS证书，以使用配置文件中定义的这些证书的更新值。

db.rotateCertificates(message)

The db.rotateCertificates() method takes the following optional argument:db.rotateCertificates()方法采用以下可选参数：

Parameter参数	Type类型	Description描述
message	string	optional.可选的。 A message logged by the server to the log file and audit file.由服务器记录到日志文件和审核文件中的消息。

The db.rotateCertificates() method wraps the rotateCertificates command.db.rotateCertificates()方法包装rotateCertificates命令。

Output输出

The db.rotateCertificates() method returns a document with the following field:db.rotateCertificates()方法返回一个具有以下字段的文档：

Behavior行为

Rotation includes the following certificates:轮换包括以下证书：

• TLS Certificates
• CRL (Certificate Revocation List) files (on Linux and Windows platforms)（在Linux和Windows平台上）
• CA (Certificate Authority) files

To rotate one or more of these certificates:要轮换其中一个或多个证书，请执行以下操作：

1. Replace the certificate or certificates you wish to rotate on the filesystem, noting the following constraints:替换要在文件系统上轮换的一个或多个证书，注意以下限制：
   • Each new certificate must have the same filename and same filepath as the certificate it is replacing.每个新证书必须具有与其要替换的证书相同的文件名和相同的文件路径。
   • If rotating an encrypted TLS Certificate, its password must be the same as the password for the old certificate (as specified to the certificateKeyFilePassword configuration file setting). Certificate rotation does not support the interactive password prompt.如果旋转加密的TLS证书，其密码必须与旧证书的密码相同（根据certificateKeyFilePassword配置文件设置指定）。证书轮换不支持交互式密码提示。
2. Connect mongosh to the mongod or mongos instance that you wish to perform certificate rotation on.将mongosh连接到要对其执行证书轮换的mongod或mongos实例。
3. Run db.rotateCertificates() to rotate the certificates used by the mongod or mongos instance.运行db.rotateCertificates()以旋转mongod或mongos实例使用的证书。

When certificate rotation takes place:证书轮换时：

• Existing connections to the mongod or mongos instance are not terminated, and will continue to use the old certificates.与mongod或mongos实例的现有连接不会终止，并且将继续使用旧证书。
• Any new connections will use the new certificates.任何新连接都将使用新证书。

If you have configured OCSP for your deployment, the db.rotateCertificates() method will also fetch stapled OCSP responses during rotation.如果您已经为部署配置了OCSP，那么db.rotateCertificates()方法也会在轮换期间获取装订好的OCSP响应。

The db.rotateCertificates() method may be run on a running mongod or mongos regardless of replication status.db.rotateCertificates()方法可以在正在运行的mongod或mongos上运行，而与复制状态无关。

Only one instance of db.rotateCertificates() or rotateCertificates may run on each mongod or mongos process at a time. 每次只能在每个mongod或mongos进程上运行db.rotateCertificates()或rotateCertificates的一个实例。Attempting to initiate a second instance while one is already running will result in an error.在第二个实例已在运行时尝试启动该实例将导致错误。

Incorrect, expired, revoked, or missing certificate files will cause the certificate rotation to fail, but will not invalidate the existing TLS configuration or terminate the running mongod or mongos process.证书文件不正确、过期、吊销或丢失将导致证书轮换失败，但不会使现有TLS配置无效或终止正在运行的mongod或mongos进程。

If the mongod or mongos is running with --tlsCertificateSelector set to thumbprint, db.rotateCertificates() will fail and write a warning message to the log file.如果mongod或mongos在运行时将--tlsCertificateSelector设置为thumbprint，则db.rotateCertificates()将失败并在日志文件中写入警告消息。

Logging日志记录

On successful rotation, the subject names, thumbprints, and the validity period of the server and cluster certificate thumbprints are logged to the configured log destination. 成功轮换后，服务器和群集证书指纹的使用者名称、指纹以及有效期将记录到配置的日志目标。If auditing is enabled, this information is also written to the audit log.如果启用了审核，则此信息也会写入审核日志。

On Linux and Windows platforms, if a CRL file is present, its thumbprint and validity period are also logged to these locations.在Linux和Windows平台上，如果存在CRL文件，其指纹和有效期也会记录到这些位置。

Required Access所需访问权限

You must have the rotateCertificates action in order to use the db.rotateCertificates() method. The rotateCertificates action is part of the hostManager role.必须具有rotateCertificates操作才能使用db.rotateCertificates()方法。rotateCertificates操作是hostManager角色的一部分。

Example实例

The following operation rotates the certificates on a running mongod instance, after having made the appropriate updates to the configuration file to specify the updated certificate information:在对配置文件进行适当更新以指定更新后的证书信息后，以下操作将旋转正在运行的mongod实例上的证书：

db.rotateCertificates()

The following performs the same as above, but also writes a custom log message at rotation time to the log file and audit file:以下操作与上述操作相同，但也会在旋转时将自定义日志消息写入日志文件和审核文件：

db.rotateCertificates("message": "Rotating certificates")