Database Manual / Self-Managed Deployments / Security / Appendix

Appendix A - OpenSSL CA Certificate for Testing Self-Managed Deployments附录A-用于测试自我管理部署的OpenSSL CA证书

Warning

Disclaimer免责声明

This page is provided for testing purposes only and the certificates are for testing purposes only.此页面仅用于测试目的，证书仅用于测试。

The following tutorial provides some guidelines for creating test X.509 certificates:以下教程提供了一些创建测试X.509证书的指南：

  • Do not use these certificates for production. Instead, follow your security policies.请勿将这些证书用于生产。相反，请遵循安全策略。
  • For information on OpenSSL, refer to the official OpenSSL docs. Although this tutorial uses OpenSSL, the material should not be taken as an authoritative reference on OpenSSL.有关OpenSSL的信息，请参阅OpenSSL官方文档。虽然本教程使用OpenSSL，但本材料不应被视为OpenSSL的权威参考。

Procedures过程

The following procedures outlines the steps to create a test CA PEM file. The procedure creates both the CA PEM file and an intermediate authority certificate and key files to sign server/client test certificates.以下过程概述了创建测试CA PEM文件的步骤。该过程创建CA PEM文件和中间授权证书以及键文件，以签署服务器/客户端测试证书。

A. Create the OpenSSL Configuration File创建OpenSSL配置文件

  1. Create a configuration file openssl-test-ca.cnf with the following content:创建一个配置文件openssl-test-ca.cnf，内容如下：

    # NOT FOR PRODUCTION USE. OpenSSL configuration file for testing.

    # For the CA policy
    [ policy_match ]
    countryName = match
    stateOrProvinceName = match
    organizationName = match
    organizationalUnitName = optional
    commonName = supplied
    emailAddress = optional

    [ req ]
    default_bits = 4096
    default_keyfile = myTestCertificateKey.pem    ## The default private key file name.
    default_md = sha256                           ## Use SHA-256 for Signatures
    distinguished_name = req_dn
    req_extensions = v3_req
    x509_extensions = v3_ca # The extensions to add to the self signed cert

    [ v3_req ]
    subjectKeyIdentifier  = hash
    basicConstraints = CA:FALSE
    keyUsage = critical, digitalSignature, keyEncipherment
    nsComment = "OpenSSL Generated Certificate for TESTING only.  NOT FOR PRODUCTION USE."
    extendedKeyUsage  = serverAuth, clientAuth

    [ req_dn ]
    countryName = Country Name (2 letter code)
    countryName_default =
    countryName_min = 2
    countryName_max = 2

    stateOrProvinceName = State or Province Name (full name)
    stateOrProvinceName_default = TestCertificateStateName
    stateOrProvinceName_max = 64

    localityName = Locality Name (eg, city)
    localityName_default = TestCertificateLocalityName
    localityName_max = 64

    organizationName = Organization Name (eg, company)
    organizationName_default = TestCertificateOrgName
    organizationName_max = 64

    organizationalUnitName = Organizational Unit Name (eg, section)
    organizationalUnitName_default = TestCertificateOrgUnitName
    organizationalUnitName_max = 64

    commonName = Common Name (eg, YOUR name)
    commonName_max = 64

    [ v3_ca ]
    # Extensions for a typical CA

    subjectKeyIdentifier=hash
    basicConstraints = critical,CA:true
    authorityKeyIdentifier=keyid:always,issuer:always
  2. Optional. You can update the default Distinguished Name (DN) values.可选。您可以更新默认的可分辨名称（DN）值。

B. Generate the Test CA PEM File生成测试CA PEM文件

  1. Create the test CA key file mongodb-test-ca.key.创建测试CA键文件mongodb-test-ca.key。

    openssl genrsa -out mongodb-test-ca.key 4096

    Tip

    This private key is used to generate valid certificates for the CA. Although this private key, like all files in this appendix, is intended for testing purposes only, you should engage in good security practices and secure this key file.此私钥用于为CA生成有效证书。虽然此私钥与本附录中的所有文件一样，仅用于测试目的，但您应该采取良好的安全措施并保护此键文件。

  2. Create the CA certificate mongod-test-ca.crt using the generated key file. When asked for Distinguished Name values, enter the appropriate values for your test CA certificate.使用生成的键文件创建CA证书mongod-test-ca.crt。当要求输入可分辨名称值时，请为测试CA证书输入适当的值。

    openssl req -new -x509 -days 1826 -key mongodb-test-ca.key -out mongodb-test-ca.crt -config openssl-test-ca.cnf

  3. Create the private key for the intermediate certificate.为中间证书创建私钥。

    openssl genrsa -out mongodb-test-ia.key 4096

    Tip

    This private key is used to generate valid certificates for the intermediate authority. 此私钥用于为中间机构生成有效证书。Although this private key, like all files in this appendix, is intended for testing purposes only, you should engage in good security practices and secure this key file.虽然此私钥与本附录中的所有文件一样，仅用于测试目的，但您应该采取良好的安全措施并保护此键文件。

  4. Create the certificate signing request for the intermediate certificate. When asked for Distinguished Name values, enter the appropriate values for your test Intermediate Authority certificate.为中间证书创建证书签名请求。当被要求输入可分辨名称值时，请为测试中级权威证书输入适当的值。

    openssl req -new -key mongodb-test-ia.key -out mongodb-test-ia.csr -config openssl-test-ca.cnf

  5. Create the intermediate certificate mongodb-test-ia.crt.创建中间证书mongodb-test-ia.crt。

    openssl x509 -sha256 -req -days 730 -in mongodb-test-ia.csr -CA mongodb-test-ca.crt -CAkey mongodb-test-ca.key -set_serial 01 -out mongodb-test-ia.crt -extfile openssl-test-ca.cnf -extensions v3_ca

  6. Create the test CA PEM file from the test CA certificate mongod-test-ca.crt and test intermediate certificate mongodb-test-ia.crt.从测试CA证书mongod-test-ca.crt和test中间证书mongodb-test iart创建测试CA PEM文件。

    cat mongodb-test-ia.crt mongodb-test-ca.crt > test-ca.pem

You can use the test PEM file when configuring mongod, mongos, or mongosh for TLS/SSL testing.在配置mongod、mongos或mongosh进行TLS/SSL测试时，您可以使用测试PEM文件。

You can use the test intermediate authority to sign the test certificates for both the server(s) and client(s). A single authority must issue the certificates for both the client and the server.您可以使用test中间机构对服务器和客户端的测试证书进行签名。必须由一个机构为客户端和服务器颁发证书。

Tip