db.rotateCertificates() (mongosh method方法)

Definition定义

db.rotateCertificates(message)

Rotates the currently used TLS certificates for a mongod or mongos to use the updated values for these certificates defined in the configuration file.旋转mongod或mongos当前使用的TLS证书，以使用配置文件中定义的这些证书的更新值。

db.rotateCertificates(message)

The db.rotateCertificates() method takes the following optional argument:db.rotateCertificates()方法接受以下可选参数：

Parameter参数	Type类型	Description描述
message	string字符串	optional A message logged by the server to the log file and audit file.可选服务器记录到日志文件和审核文件中的消息。

The db.rotateCertificates() method wraps the rotateCertificates command.db.rotateCertificates()方法封装了rotateCertificates命令。

Compatibility兼容性

This method is available in deployments hosted in the following environments:此方法在以下环境中托管的部署中可用：

• MongoDB Enterprise: The subscription-based, self-managed version of MongoDB：MongoDB的基于订阅的自我管理版本
• MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB：MongoDB的源代码可用、免费使用和自我管理版本

Output输出

The db.rotateCertificates() method returns a document with the following field:db.rotateCertificates()方法返回一个包含以下字段的文档：

Behavior行为

Rotation includes the following certificates:轮换包括以下证书：

• TLS Certificates
• CRL (Certificate Revocation List) files (on Linux and Windows platforms)（在Linux和Windows平台上）
• CA (Certificate Authority) files

To rotate one or more of these certificates:要轮换其中一个或多个证书，请执行以下操作：

1. Replace the certificate or certificates you wish to rotate on the filesystem, noting the following constraints:替换您希望在文件系统上轮换的一个或多个证书，注意以下限制：

   • Each new certificate must have the same filename and same filepath as the certificate it is replacing.每个新证书必须具有与其替换的证书相同的文件名和文件路径。
   • If rotating an encrypted TLS Certificate, its password must be the same as the password for the old certificate (as specified to the certificateKeyFilePassword configuration file setting). Certificate rotation does not support the interactive password prompt.如果轮换加密的TLS证书，其密码必须与旧证书的密码相同（如certificateKeyFilePassword配置文件设置中指定的）。证书轮换不支持交互式密码提示。
2. Connect mongosh to the mongod or mongos instance that you wish to perform certificate rotation on.将mongosh连接到要对其执行证书轮换的mongod或mongos实例。
3. Run db.rotateCertificates() to rotate the certificates used by the mongod or mongos instance.运行db.rotateCertificates()来轮换mongod或mongos实例使用的证书。

When certificate rotation takes place:证书轮换时：

• Existing connections to the mongod or mongos instance are not terminated, and will continue to use the old certificates.与mongod或mongos实例的现有连接不会终止，并将继续使用旧证书。
• Any new connections will use the new certificates.任何新连接都将使用新证书。

If you have configured OCSP for your deployment, the db.rotateCertificates() method will also fetch stapled OCSP responses during rotation.如果您已为部署配置了OCSP，db.rotateCertificates()方法还将在轮换期间获取装订好的OCSP响应。

The db.rotateCertificates() method may be run on a running mongod or mongos regardless of replication status.db.rotateCertificates()方法可以在正在运行的mongod或mongos上运行，而不管复制状态如何。

Only one instance of db.rotateCertificates() or rotateCertificates may run on each mongod or mongos process at a time. 一次只能在每个mongod或mongos进程上运行一个db.rotateCertificates()或rotateCertificates实例。Attempting to initiate a second instance while one is already running will result in an error.在一个实例已在运行时尝试启动第二个实例将导致错误。

Incorrect, expired, revoked, or missing certificate files will cause the certificate rotation to fail, but will not invalidate the existing TLS configuration or terminate the running mongod or mongos process.不正确、过期、吊销或丢失的证书文件将导致证书轮换失败，但不会使现有的TLS配置无效或终止正在运行的mongod或mongos进程。

If the mongod or mongos is running with --tlsCertificateSelector set to thumbprint, db.rotateCertificates() will fail and write a warning message to the log file.如果mongod或mongos在将--tlsCertificateSelector设置为thumbprint的情况下运行，db.rotateCertificates()将失败，并在日志文件中写入警告消息。

Logging日志记录

On successful rotation, the subject names, thumbprints, and the validity period of the server and cluster certificate thumbprints are logged to the configured log destination. 成功轮换后，主题名称、指纹以及服务器和群集证书指纹的有效期将记录到配置的日志目标中。If auditing is enabled, this information is also written to the audit log.如果启用了审核，此信息也会写入审核日志。

On Linux and Windows platforms, if a CRL file is present, its thumbprint and validity period are also logged to these locations.在Linux和Windows平台上，如果存在CRL文件，其指纹和有效期也会记录到这些位置。

Required Access所需访问权限

You must have the rotateCertificates action in order to use the db.rotateCertificates() method. 您必须具有rotateCertificates操作才能使用db.rotateCertificates()方法。The rotateCertificates action is part of the hostManager role.rotateCertificates操作是hostManager角色的一部分。

Example示例

The following operation rotates the certificates on a running mongod instance, after having made the appropriate updates to the configuration file to specify the updated certificate information:在对配置文件进行了适当的更新以指定更新的证书信息后，以下操作将轮换正在运行的mongod实例上的证书：

db.rotateCertificates()

The following performs the same as above, but also writes a custom log message at rotation time to the log file and audit file:以下操作与上述操作相同，但也会在轮换时将自定义日志消息写入日志文件和审核文件：

db.rotateCertificates("message": "Rotating certificates")