Configure mongod and mongos for TLS/SSL on Self-Managed Deployments在自我管理部署上配置mongod和mongos的TLS/SSL

Certificate Authorities证书颁发机构

For production use, your MongoDB deployment should use valid certificates generated and signed by a certificate authority. You or your organization can generate and maintain an independent certificate authority, or use certificates generated by third-party TLS vendors. Obtaining and managing certificates is beyond the scope of this documentation.对于生产使用，MongoDB部署应该使用由证书颁发机构生成和签名的有效证书。您或组织可以生成和维护独立的证书颁发机构，或使用第三方TLS供应商生成的证书。获取和管理证书超出了本文档的范围。

mongod --setParameter enforceUserClusterSeparation=false

mongod and mongos Certificate Key Filemongod和mongos证书键文件

When establishing a TLS/SSL connection, the mongod / mongos presents a certificate key file to its clients to establish its identity. 在建立TLS/SSL连接时，mongod/mongos向其客户端提供证书键文件以建立其身份。[1] The certificate key file contains a public key certificate and its associated private key, but only the public component is revealed to the client.证书键文件包含公钥证书及其关联的私钥，但只向客户端显示公共组件。

MongoDB can use any valid TLS/SSL certificate issued by a certificate authority, or a self-signed certificate. MongoDB可以使用证书颁发机构颁发的任何有效TLS/SSL证书或自签名证书。If you use a self-signed certificate, although the communications channel will be encrypted to prevent eavesdropping on the connection, there will be no validation of server identity. 如果您使用自签名证书，尽管通信通道将被加密以防止连接被窃听，但不会对服务器身份进行验证。This leaves you vulnerable to a man-in-the-middle attack. Using a certificate signed by a trusted certificate authority will permit MongoDB drivers to verify the server's identity.这会使您容易受到中间人攻击。使用由受信任的证书颁发机构签名的证书将允许MongoDB驱动程序验证服务器的身份。

In general, avoid using self-signed certificates unless the network is trusted.一般来说，除非网络是可信的，否则避免使用自签名证书。

With regards to certificates for replica set and sharded cluster members, it is advisable to use different certificates on different servers. This minimizes exposure of the private key and allows for hostname validation.关于副本集和分片集群成员的证书，建议在不同的服务器上使用不同的证书。这最大限度地减少了私钥的暴露，并允许主机名验证。

Set Up mongod and mongos with TLS/SSL Certificate and Key使用TLS/SSL证书和键设置mongod和mongos

The following section configures mongod / mongos to use TLS/SSL connections. 以下部分将配置mongod/mongos以使用TLS/SSL连接。With these TLS/SSL settings, mongod / mongos presents its certificate key file to the client. 通过这些TLS/SSL设置，mongod/mongos向客户端提供其证书键文件。However, the mongod / mongos does not require a certificate key file from the client to verify the client's identity. 但是，mongod/mongos不需要客户端的证书键文件来验证客户端的身份。To require client's certificate key file, see Set Up mongod and mongos with Client Certificate Validation instead.要要求客户端的证书键文件，请参阅使用客户端证书验证设置mongod和mongos。

To use TLS/SSL connections, include the following TLS/SSL settings in your mongod / mongos instance's configuration file:要使用TLS/SSL连接，请在mongod/mongos实例的配置文件中包含以下TLS/SSL设置：

net:
   tls:
      mode: requireTLS
      certificateKeyFile: /etc/ssl/mongodb.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

net:
   tls:
      mode: requireTLS
      certificateSelector: subject="<CertificateCommonName>"
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

A mongod instance that uses the above configuration can only accept TLS/SSL connections:使用上述配置的mongod实例只能接受TLS/SSL连接：

mongod --config <path/to/configuration/file>

See Connect to MongoDB Instances Using Encryption for more information on connecting with TLS/SSL.有关使用TLS/SSL连接的更多信息，请参阅使用加密连接到MongoDB实例。

Set Up mongod and mongos with Client Certificate Validation使用客户端证书验证设置mongod和mongos

The following section configures mongod / mongos to use TLS/SSL connections and perform client certificate validation. With these TLS/SSL settings:以下部分将配置mongod/mongos以使用TLS/SSL连接并执行客户端证书验证。使用这些TLS/SSL设置：

• mongod / mongos presents its certificate key file to the client for verification.将其证书键文件呈现给客户端进行验证。
• mongod / mongos requires a certificate key file from the client to verify the client's identity.需要来自客户端的证书键文件来验证客户端的身份。

To use TLS/SSL connections and perform client certificate validation, include the following TLS/SSL settings in your mongod / mongos instance's configuration file:要使用TLS/SSL连接并执行客户端证书验证，请在mongod/mongos实例的配置文件中包含以下TLS/SSL设置：

For example, consider the following configuration file for a mongod instance:例如，考虑以下mongod实例的配置文件：

net:
   tls:
      mode: requireTLS
      certificateKeyFile: /etc/ssl/mongodb.pem
      CAFile: /etc/ssl/caToValidateClientCertificates.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

A mongod instance that uses the above configuration can only accept TLS/SSL connections and requires a valid certificate from its clients:使用上述配置的mongod实例只能接受TLS/SSL连接，并要求其客户端提供有效证书：

mongod --config <path/to/configuration/file>

Clients must specify TLS/SSL connections and present their certificate key file to the instance. 客户端必须指定TLS/SSL连接，并向实例提供其证书键文件。See Connect to MongoDB Instances that Require Client Certificates for more information on connecting with TLS/SSL.有关使用TLS/SSL连接的更多信息，请参阅连接到需要客户端证书的MongoDB实例。

net:
   tls:
      mode: requireTLS
      certificateKeyFile: /etc/ssl/mongodb.pem
      CAFile: /etc/ssl/caToValidateClientCertificates.pem
      CRLFile: /etc/ssl/revokedCertificates.pem

net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/caToValidateClientCertificates.pem
    allowConnectionsWithoutCertificates: true

Disallow Protocols不允许协议

To prevent MongoDB servers from accepting incoming connections that use specific protocols, include net.tls.disabledProtocols set to the disallowed protocols.为了防止MongoDB服务器接受使用特定协议的传入连接，请将net.tls.disabledProtocols设置为不允许的协议。

For example, the following configuration prevents mongod / mongos from accepting incoming connections that use either TLS1_0 or TLS1_1例如，以下配置阻止mongod/mongos接受使用TLS1_0或TLS1_1的传入连接

net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/caToValidateClientCertificates.pem
    disabledProtocols: TLS1_0,TLS1_1

TLS/SSL Certificate Passphrase证书密码

If the certificate key files for mongod / mongos are encrypted, include net.tls.certificateKeyFilePassword set to the passphrase.如果mongod/mongos的证书键文件已加密，请将net.tls.certificateKeyFilePassword设置为密码。

Online Certificate Rotation在线证书轮换

Starting in MongoDB 5.0, you can rotate the following certificate key files on-demand:从MongoDB 5.0开始，您可以按需轮换以下证书键文件：

• TLS Certificates
• CRL (Certificate Revocation List) files (on Linux and Windows platforms)（在Linux和Windows平台上）
• CA (Certificate Authority) files

To rotate one or more of these certificates:要轮换其中一个或多个证书，请执行以下操作：

1. Replace the certificate or certificates you wish to rotate on the filesystem, noting the following constraints:替换您希望在文件系统上轮换的一个或多个证书，注意以下限制：

   • Each new certificate must have the same filename and same filepath as the certificate it is replacing.每个新证书必须具有与其替换的证书相同的文件名和文件路径。
   • If rotating an encrypted TLS Certificate, its password must be the same as the password for the old certificate (as specified to the certificateKeyFilePassword configuration file setting). 如果轮换加密的TLS证书，其密码必须与旧证书的密码相同（如certificateKeyFilePassword配置文件设置中指定的）。Certificate rotation does not support the interactive password prompt.证书轮换不支持交互式密码提示。
2. Connect mongosh to the mongod or mongos instance that you wish to perform certificate rotation on.将mongosh连接到要对其执行证书轮换的mongod或mongos实例。
3. Run the rotateCertificates command or the db.rotateCertificates() shell method to rotate the certificates used by the mongod or mongos instance.运行rotateCertificates命令或db.rotateCertificates()shell方法来轮换mongod或mongos实例使用的证书。

When certificate rotation takes place:证书轮换时：

• Existing connections to the mongod or mongos instance are not terminated, and will continue to use the old certificates.与mongod或mongos实例的现有连接不会终止，并将继续使用旧证书。
• Any new connections will use the new certificates.任何新连接都将使用新证书。

Incorrect, expired, revoked, or missing certificate files will cause the certificate rotation to fail, but will not invalidate the existing TLS configuration or terminate the running mongod or mongos process.不正确、过期、吊销或丢失的证书文件将导致证书轮换失败，但不会使现有的TLS配置无效或终止正在运行的mongod或mongos进程。

Previous to MongoDB 5.0, certificate rotation required downtime, and was typically performed during maintenance windows.在MongoDB 5.0之前，证书轮换需要停机，通常在维护窗口期间执行。

See rotateCertificates or db.rotateCertificates() for additional considerations and full usage instructions.有关其他注意事项和完整使用说明，请参阅rotateCertificates或db.rotateCertificates()。

Run in FIPS Mode在FIPS模式下运行

See Configure MongoDB for FIPS for more details.有关更多详细信息，请参阅配置MongoDB for FIPS。

Next Steps后续步骤

To configure TLS/SSL support for clients, see TLS/SSL Configuration for Clients.要为客户端配置TLS/SSL支持，请参阅客户端的TLS/SSL配置。

Set Up mongod and mongos with TLS/SSL Certificate and Key使用TLS/SSL证书和键设置mongod和mongos

The following section configures mongod / mongos to use TLS/SSL connections. 以下部分将配置mongod/mongos以使用TLS/SSL连接。With these TLS/SSL settings, mongod / mongos presents its certificate key file to the client. 通过这些TLS/SSL设置，mongod/mongos向客户端提供其证书键文件。However, the mongod / mongos does not require a certificate key file from the client to verify the client's identity. 但是，mongod/mongos不需要客户端的证书键文件来验证客户端的身份。To require client's certificate key file, see Set Up mongod and mongos with Client Certificate Validation instead.要要求客户端的证书键文件，请参阅使用客户端证书验证设置mongod和mongos。

To use TLS/SSL connections, include the following TLS/SSL settings in your mongod / mongos instance's configuration file:要使用TLS/SSL连接，请在mongod/mongos实例的配置文件中包含以下TLS/SSL设置：

net:
   ssl:
      mode: requireSSL
      PEMKeyFile: /etc/ssl/mongodb.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

net:
   ssl:
      mode: requireSSL
      certificateSelector: subject="<CertificateCommonName>"
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

A mongod instance that uses the above configuration can only accept TLS/SSL connections:使用上述配置的mongod实例只能接受TLS/SSL连接：

mongod --config <path/to/configuration/file>

See Connect to MongoDB Instances Using Encryption for more information on connecting with TLS/SSL.有关使用TLS/SSL连接的更多信息，请参阅使用加密连接到MongoDB实例。

Set Up mongod and mongos with Client Certificate Validation使用客户端证书验证设置mongod和mongos

The following section configures mongod / mongos to use TLS/SSL connections and perform client certificate validation. With these TLS/SSL settings:以下部分将配置mongod/mongos以使用TLS/SSL连接并执行客户端证书验证。使用这些TLS/SSL设置：

• mongod / mongos presents its certificate key file to the client for verification.将其证书键文件呈现给客户端进行验证。
• mongod / mongos requires a certificate key file from the client to verify the client's identity.需要来自客户端的证书键文件来验证客户端的身份。

To use TLS/SSL connections, include the following TLS/SSL settings in your mongod / mongos instance's configuration file:要使用TLS/SSL连接，请在mongod/mongos实例的配置文件中包含以下TLS/SSL设置：

For example, consider the following configuration file for a mongod instance:例如，考虑以下mongod实例的配置文件：

net:
   ssl:
      mode: requireSSL
      PEMKeyFile: /etc/ssl/mongodb.pem
      CAFile: /etc/ssl/caToValidateClientCertificates.pem
systemLog:
   destination: file
   path: "/var/log/mongodb/mongod.log"
   logAppend: true
storage:
   dbPath: "/var/lib/mongodb"
processManagement:
   fork: true
net:
   bindIp: localhost,mongodb0.example.net
   port: 27017

A mongod instance that uses the above configuration can only accept TLS/SSL connections and requires a valid certificate from its clients:使用上述配置的mongod实例只能接受TLS/SSL连接，并要求其客户端提供有效证书：

mongod --config <path/to/configuration/file>

Clients must specify TLS/SSL connections and present their certificate key file to the instance. 客户端必须指定TLS/SSL连接，并向实例提供其证书键文件。See Connect to MongoDB Instances that Require Client Certificates for more information on connecting with TLS/SSL.有关使用TLS/SSL连接的更多信息，请参阅连接到需要客户端证书的MongoDB实例。

net:
   ssl:
      mode: requireSSL
      PEMKeyFile: /etc/ssl/mongodb.pem
      CAFile: /etc/ssl/caToValidateClientCertificates.pem
      CRLFile: /etc/ssl/revokedCertificates.pem

net:
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/caToValidateClientCertificates.pem
    allowConnectionsWithoutCertificates: true

Disallow Protocols不允许协议

To prevent MongoDB servers from accepting incoming connections that use specific protocols, include net.ssl.disabledProtocols set to the disallowed protocols.为了防止MongoDB服务器接受使用特定协议的传入连接，请将net.ssl.disabledProtocols设置为不允许的协议。

For example, the following configuration prevents mongod / mongos from accepting incoming connections that use either TLS1_0 or TLS1_1例如，以下配置阻止mongod/mongos接受使用TLS1_0或TLS1_1的传入连接

net:
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/caToValidateClientCertificates.pem
    disabledProtocols: TLS1_0,TLS1_1

TLS/SSL Certificate PassphraseTLS/SSL证书密码

If the certificate key files for mongod / mongos are encrypted, include net.ssl.PEMKeyPassword set to the passphrase.如果mongod/mongos的证书键文件已加密，请将net.ssl.PEMKeyPassword设置为密码。

Run in FIPS Mode在FIPS模式下运行

See Configure MongoDB for FIPS for more details.有关更多详细信息，请参阅配置MongoDB for FIPS。

Next Steps后续步骤

To configure TLS/SSL support for clients, see TLS/SSL Configuration for Clients.要为客户端配置TLS/SSL支持，请参阅客户端的TLS/SSL配置。