Database Manual / Self-Managed Deployments / Security / Appendix

Appendix B - OpenSSL Server Certificates for Testing Self-Managed Deployments附录B-用于测试自我管理部署的OpenSSL服务器证书

Warning

Disclaimer免责声明

This page is provided for testing purposes only and the certificates are for testing purposes only.此页面仅用于测试目的，证书仅用于测试。

The following tutorial provides some basic steps for creating test X.509 certificates:以下教程提供了创建测试X.509证书的一些基本步骤：

  • Do not use these certificates for production. Instead, follow your security policies.请勿将这些证书用于生产。相反，请遵循安全策略。
  • For information on OpenSSL, refer to the official OpenSSL docs. Although this tutorial uses OpenSSL, the material should not be taken as an authoritative reference on OpenSSL.有关OpenSSL的信息，请参阅OpenSSL官方文档。虽然本教程使用OpenSSL，但本材料不应被视为OpenSSL的权威参考。

Prerequisite先决条件

The procedure outlined on this page uses the test intermediate authority certificate and key mongodb-test-ia.crt and mongodb-test-ia.key created in Appendix A - OpenSSL CA Certificate for Testing Self-Managed Deployments .本页概述的程序使用附录A-用于测试自我管理部署的OpenSSL CA证书中创建的测试中间授权证书和键mongodb-test-ia.crt和mongodb-test-ia.key。

Procedure过程

The following procedure outlines the steps to create test certificates for MongoDB servers. 以下过程概述了为MongoDB服务器创建测试证书的步骤。For steps to create test certificates for MongoDB clients, see Appendix C - OpenSSL Client Certificates for Testing Self-Managed Deployments.有关为MongoDB客户端创建测试证书的步骤，请参阅附录C-用于测试自我管理部署的OpenSSL客户端证书。

A. Create the OpenSSL Configuration File创建OpenSSL配置文件

  1. Create a test configuration file openssl-test-server.cnf for your server with the following content:为服务器创建一个测试配置文件openssl-test-server.cnf，其中包含以下内容：

    # NOT FOR PRODUCTION USE. OpenSSL configuration file for testing.


    [ req ]
    default_bits = 4096
    default_keyfile = myTestServerCertificateKey.pem    ## The default private key file name.
    default_md = sha256
    distinguished_name = req_dn
    req_extensions = v3_req

    [ v3_req ]
    subjectKeyIdentifier  = hash
    basicConstraints = CA:FALSE
    keyUsage = critical, digitalSignature, keyEncipherment
    nsComment = "OpenSSL Generated Certificate for TESTING only.  NOT FOR PRODUCTION USE."
    extendedKeyUsage  = serverAuth, clientAuth
    subjectAltName = @alt_names

    [ alt_names ]
    DNS.1 =         ##TODO: Enter the DNS names. The DNS names should match the server names.
    DNS.2 =         ##TODO: Enter the DNS names. The DNS names should match the server names.
    IP.1 =          ##TODO: Enter the IP address.
    IP.2 =          ##TODO: Enter the IP address.

    [ req_dn ]
    countryName = Country Name (2 letter code)
    countryName_default = TestServerCertificateCountry
    countryName_min = 2
    countryName_max = 2

    stateOrProvinceName = State or Province Name (full name)
    stateOrProvinceName_default = TestServerCertificateState
    stateOrProvinceName_max = 64

    localityName = Locality Name (eg, city)
    localityName_default = TestServerCertificateLocality
    localityName_max = 64

    organizationName = Organization Name (eg, company)
    organizationName_default = TestServerCertificateOrg
    organizationName_max = 64

    organizationalUnitName = Organizational Unit Name (eg, section)
    organizationalUnitName_default = TestServerCertificateOrgUnit
    organizationalUnitName_max = 64

    commonName = Common Name (eg, YOUR name)
    commonName_max = 64

  2. In the [alt_names] section, enter the appropriate DNS names and/or IP addresses for the MongoDB server. You can specify multiple DNS names for a MongoDB server.在[alt_names]部分，输入MongoDB服务器的相应DNS名称和/或IP地址。您可以为MongoDB服务器指定多个DNS名称。

    For OpenSSL SAN identifiers, MongoDB supports:对于OpenSSL SAN标识符，MongoDB支持：

    • DNS names and/orDNS名称和/或
    • IP address fieldsIP地址字段
  3. Optional. You can update the default Distinguished Name (DN) values可选。您可以更新默认的可分辨名称（DN）值.

Tip

  • Specify a non-empty value for at least one of the following attributes: Organization (O), the Organizational Unit (OU), or the Domain Component (DC).为以下属性中的至少一个指定非null值：组织（O）、组织单位（OU）或域组件（DC）。

  • When creating test server certificates for internal membership authentication, the following attributes, if specified, must match exactly across the member certificates: Organization (O), Organizational Unit (OU), the Domain Component (DC).在为内部成员身份验证创建测试服务器证书时，如果指定了以下属性，则这些属性必须在成员证书之间完全匹配：组织（O）、组织单位（OU）、域组件（DC）。

    For more information on requirements for internal membership authentication, see membership authentication.有关内部成员身份验证要求的更多信息，请参阅成员身份验证。

B. Generate the Test PEM File for Server为服务器生成测试PEM文件

Important

Before proceeding, ensure that you have entered the appropriate DNS names in the [alt_names] section of the configuration file openssl-test-server.cnf.在继续之前，请确保您已在配置文件openssl-test-server.cnf的[alt_names]部分输入了相应的DNS名称。

  1. Create the test key file mongodb-test-server1.key.

    openssl genrsa -out mongodb-test-server1.key 4096

  2. Create the test certificate signing request mongodb-test-server1.csr.

    When asked for Distinguished Name values, enter the appropriate values for your test certificate:当被要求输入可分辨名称值时，请为测试证书输入适当的值：

    • Specify a non-empty value for at least one of the following attributes: Organization (O), the Organizational Unit (OU), or the Domain Component (DC).为以下属性中的至少一个指定非null值：组织（O）、组织单位（OU）或域组件（DC）。
    • When creating test server certificates for internal membership authentication, the following attributes, if specified, must match exactly across the member certificates: Organization (O), Organizational Unit (OU), the Domain Component (DC).在为内部成员身份验证创建测试服务器证书时，如果指定了以下属性，则这些属性必须在成员证书之间完全匹配：组织（O）、组织单位（OU）、域组件（DC）。
    openssl req -new -key mongodb-test-server1.key -out mongodb-test-server1.csr -config openssl-test-server.cnf

  3. Create the test server certificate mongodb-test-server1.crt.创建测试服务器证书mongodb-test-server1.crt。

    openssl x509 -sha256 -req -days 365 -in mongodb-test-server1.csr -CA mongodb-test-ia.crt -CAkey mongodb-test-ia.key -CAcreateserial -out mongodb-test-server1.crt -extfile openssl-test-server.cnf -extensions v3_req

  4. Create the test PEM file for the server.为服务器创建测试PEM文件。

    cat mongodb-test-server1.crt mongodb-test-server1.key > test-server1.pem

    You can use the test PEM file when configuring a mongod or a mongos for TLS/SSL testing. For example:在配置mongod或mongos进行TLS/SSL测试时，您可以使用测试PEM文件。例如：

    Example示例

    mongod --tlsMode requireTLS --tlsCertificateKeyFile test-server1.pem  --tlsCAFile test-ca.pem
    On macOS,

    If you are testing with Keychain Access to manage certificates, create a pkcs-12 file to add to Keychain Access instead of a PEM file:如果您正在使用Keychain Access进行测试以管理证书，请创建一个pkcs-12文件以添加到Keychain Access中，而不是PEM文件：

    openssl pkcs12 -export -out test-server1.pfx -inkey mongodb-test-server1.key -in mongodb-test-server1.crt -certfile mongodb-test-ia.crt

    Once added to Keychain Access, instead of specifying the certificate key file, you can use the --tlsCertificateSelector to specify the certificate to use. If the CA file is also in Keychain Access, you can omit --tlsCAFile as well.添加到Keychain Access后，您可以使用--tlsCertificateSelector指定要使用的证书，而不是指定证书键文件。如果CA文件也在Keychain Access中，您也可以省略--tlsCAFile。

    mongod --tlsMode requireTLS --tlsCertificateSelector subject="<TestServerCertificateCommonName>"

Tip