Use X.509 Certificates for Membership Authentication with Self-Managed MongoDB使用X.509证书进行自我管理MongoDB的成员身份验证

Certificate Requirements证书要求

When TLS is enabled, use member certificates to verify membership to internal connections in a sharded cluster or a replica set. 启用TLS后，使用成员证书验证分片集群或副本集中内部连接的成员资格。You can configure member certificate file paths with the net.tls.clusterFile and net.tls.certificateKeyFile options. 您可以使用net.tls.clusterFile和net.tls.certificateKeyFile选项配置成员证书文件路径。Members have the following configuration requirements:成员具有以下配置要求：

• Cluster member configuration must specify a non-empty value for at least one of the attributes used for authentication. By default, MongoDB accepts:群集成员配置必须为用于身份验证的至少一个属性指定非null值。默认情况下，MongoDB接受：

  • the Organization (O)
  • the Organizational Unit (OU)
  • the Domain Component (DC)

  MongoDB verifies that entries match exactly across all member certificates. If you list multiple OU values, all certificates must use an identical list.MongoDB验证所有成员证书中的条目是否完全匹配。如果列出多个OU值，则所有证书必须使用相同的列表。

  You can specify alternative attributes to use for authentication by setting net.tls.clusterAuthX509.extensionValue.您可以通过设置net.tls.clusterAuthX509.extensionValue来指定用于身份验证的替代属性。

• Cluster member configuration must include the same net.tls.clusterAuthX509.attributes and use matching values. 群集成员配置必须包含相同的net.tls.clusterAuthX509.attributes，并使用匹配的值。Attribute order doesn't matter. The following example sets O and OU, but not DC:属性顺序并不重要。以下示例设置了O和OU，但没有设置DC：

  net:
    tls:
      clusterAuthX509:
        attributes: O=MongoDB, OU=MongoDB Server

mongod --setParameter enforceUserClusterSeparation=false

The certificates have the following requirements:证书有以下要求：

• A single Certificate Authority (CA) must issue all X.509 certificates for the members of a sharded cluster or a replica set.单个证书颁发机构（CA）必须为分片集群或副本集的成员颁发所有X.509证书。

• At least one of the Subject Alternative Name (SAN) entries must match the server hostname used by other cluster members. When comparing SANs, MongoDB can compare either DNS names or IP addresses.至少有一个主题备选名称（SAN）条目必须与其他群集成员使用的服务器主机名匹配。在比较SAN时，MongoDB可以比较DNS名称或IP地址。

  If you don't specify subjectAltName, MongoDB compares the Common Name (CN) instead. However, this usage of CN is deprecated per RFC2818如果不指定subjectAltName，MongoDB会比较通用名（CN）。然而，根据RFC2818，CN的这种用法已被弃用

• If the certificate used as the certificateKeyFile includes extendedKeyUsage, the value must include both clientAuth ("TLS Web Client Authentication") and serverAuth ("TLS Web Server Authentication").如果用作certificateKeyFile的证书包括extendedKeyUsage，则该值必须同时包括clientAuth（“TLS Web客户端身份验证”）和serverAuth（”TLS Web服务器身份验证“）。

  extendedKeyUsage = clientAuth, serverAuth

• If the certificate used as the clusterFile includes extendedKeyUsage, the value must include clientAuth.如果用作clusterFile的证书包括extendedKeyUsage，则该值必须包括clientAuth。

  extendedKeyUsage = clientAuth

Use Command-line Options使用命令行选项 (tls)

mongod --replSet <name> --tlsMode requireTLS --clusterAuthMode x509 --tlsClusterFile <path to membership certificate and key PEM file> --tlsCertificateKeyFile <path to TLS/SSL certificate and key file> --tlsCAFile <path to root CA file> --bind_ip localhost,<hostname(s)|ip address(es)>

security:
   clusterAuthMode: x509
net:
   tls:
      mode: requireTLS
      certificateKeyFile: <path to its TLS/SSL certificate and key file>
      CAFile: <path to root CA PEM file to verify received certificate>
      clusterFile: <path to its certificate key file for membership authentication>
   bindIp: localhost,<hostname(s)|ip address(es)>

For more information, see Configure mongod and mongos for TLS/SSL on Self-Managed Deployments.有关更多信息，请参阅在自我管理部署上为TLS/SSL配置mongod和mongos。

Use Command-line Options使用命令行选项 (ssl)

mongod --replSet <name> --sslMode requireSSL --clusterAuthMode x509 --sslClusterFile <path to membership certificate and key PEM file> --sslPEMKeyFile <path to TLS/SSL certificate and key PEM file> --sslCAFile <path to root CA PEM file> --bind_ip localhost,<hostname(s)|ip address(es)>

security:
   clusterAuthMode: x509
net:
   ssl:
      mode: requireSSL
      PEMKeyFile: <path to TLS/SSL certificate and key PEM file>
      CAFile: <path to root CA PEM file>
      clusterFile: <path to X.509 membership certificate and key PEM file>
   bindIp: localhost,<hostname(s)|ip address(es)>

For more information, see Configure mongod and mongos for TLS/SSL on Self-Managed Deployments.有关更多信息，请参阅在自我管理部署上为TLS/SSL配置mongod和mongos。