Database Manual / Self-Managed Deployments / Security / Authentication / Internal

Rotate X.509 Certificates with clusterAuthX509 Attributes on Self-Managed Clusters在自我管理集群上旋转具有clusterAuthX509属性的X.509证书

New in version 7.0.在版本7.0中新增。

Cluster members can use X.509 certificates for membership authentication to identify other servers in the same deployment. This tutorial describes how to perform a rolling update to rotate X.509 certificates on a cluster that uses the net.tls.clusterAuthX509.attributes settings to configure the cluster members' Distinguished Name (DN) attributes.集群成员可以使用X.509证书进行成员身份验证，以识别同一部署中的其他服务器。本教程介绍如何在使用net.tls.clusterAuthX509.attributes属性设置配置集群成员的可分辨名称（DN）属性的集群上执行滚动更新以轮换X.509证书。

Note

To perform a rolling update to rotate certificates on a cluster that doesn't use the net.tls.clusterAuthX509 settings and won't after the update, see Rotate X.509 Certificates without clusterAuthX509 Attributes on Self-Managed Clusters.要执行滚动更新以轮换不使用net.tls.clusterAuthX509设置且更新后也不会使用的群集上的证书，请参阅在自管理群集上旋转没有clusterAuthX508属性的X.509证书。

When a server configured with the net.tls.clusterAuthX509.attributes setting receives a connection request, it compares the Distinguished Name (DN) attributes in the subject field of the presented certificates to the configured values of the attributes setting and tlsClusterAuthX509Override parameter. 当配置了net.tls.clusterAuthX509.attributes设置的服务器收到连接请求时，它会将所提供证书subject字段中的可分辨名称（DN）属性与attributes设置和tlsClusterAuthX509Override参数的配置值进行比较。If the values match, it treats the connection as a cluster member.如果值匹配，则将连接视为集群成员。

In some situations, you may need to update the member certificates to new certificates with a new Distinguished Name (DN), such as if an organization changes its name. In a rolling update, member certificates are updated one at a time, and your deployment does not incur any downtime.在某些情况下，您可能需要将成员证书更新为具有新可分辨名称（DN）的新证书，例如当组织更改其名称时。在滚动更新中，成员证书一次更新一个，部署不会导致任何停机。

Clusters adopting new certificates can use the tlsClusterAuthX509Override parameter to accept X.509 certificates with different subject DN attributes during the certificate rotation procedure. 采用新证书的群集可以在证书轮换过程中使用tlsClusterAuthX509Override参数接受具有不同主题DN属性的X.509证书。Once all members use certificates with the new value, remove the override to begin rejecting the now out of date certificates.一旦所有成员使用具有新值的证书，请删除覆盖以开始拒绝现已过期的证书。

About This Task关于此任务

Consider a replica set where member certificates, set using the clusterFile and certificateKeyFile settings, have Distinguished Name (DN) attributes that use the 10gen organization and 10gen Server organizational unit. 考虑一个副本集，其中使用clusterFile和certificateKeyFile设置设置的成员证书具有使用10gen组织和10gen Server组织单位的可分辨名称（DN）属性。These DN attributes are set using the net.tls.clusterAuthX509.attributes setting.这些DN属性是使用net.tls.clusterAuthX509.attributes设置的。

A member of this replica set has the following configuration file:此副本集的成员具有以下配置文件：

security:
  clusterAuthMode:      x509
net:
  tls:
    mode:               requireTLS
    certificateKeyFile: /etc/mycerts/10gen-server1.pem
    CAFile:             /etc/mycerts/ca.pem
    clusterFile:        /etc/mycerts/10gen-cluster1.pem
    clusterCAFile:      /etc/mycerts/ca.pem
    clusterAuthX509:
       attributes:      O=10gen, OU=10gen Server

The following procedure updates each replica set member's X.509 certificates to new certificates that have DN attributes that use the MongoDB organization and MongoDB Server organizational unit.以下过程将每个副本集成员的X.509证书更新为具有使用MongoDB组织和MongoDB服务器组织单元的DN属性的新证书。

Note

The following procedure assumes that the new X.509 certificates meet membership certificate and all other requirements and that the cluster configuration identifies peer certificates using Distinguished Name (DN) values. 以下过程假设新的X.509证书满足成员证书和所有其他要求，并且集群配置使用可分辨名称（DN）值标识对等证书。For more information, see Member Certificate Requirements.有关更多信息，请参阅会员证书要求。

Steps步骤

These steps update member certificates to use new X.509 certificates on a cluster configured with the net.tls.clusterAuthX509.attributes setting.这些步骤更新成员证书，以便在配置了net.tls.clusterAuthX509.attributes设置的集群上使用新的X.509证书。

The new certificates have Distinguished Names (DN) that change the Organization (O) attributes from 10gen to MongoDB and the Organizational Unit (OU) attribute from 10gen Server to MongoDB Server.新证书具有可分辨名称（DN），将组织（O）属性从10gen更改为MongoDB，将组织单元（OU）属性从10g服务器更改为MongoDB服务器。

1

Update the TLS Cluster Membership Configuration更新TLS群集成员资格配置

Update the configuration file of each server:更新每台服务器的配置文件：

For example:例如：

net:
  tls:
    mode:               requireTLS
    certificateKeyFile: /etc/mycerts/mongodb-server1.pem
    CAFile:             /etc/mycerts/ca.pem
    clusterFile:        /etc/mycerts/mongodb-cluster1.pem
    clusterCAFile:      /etc/mycerts/ca.pem
    clusterAuthX509:
       attributes:      O=MongoDB, OU=MongoDB Server
security:
  clusterAuthMode: x509
setParameter:
   tlsClusterAuthX509Override: { attributes: O=10gen, OU=10gen Server }
2

Restart Secondary Cluster Members重新启动辅助群集成员

Restart each secondary cluster member:重新启动每个次群集成员：

  1. Use mongosh to connect to each secondary cluster member, then use the db.shutdownServer() method to stop the server:使用mongosh连接到每个辅助集群成员，然后使用db.shutdownServer()方法停止服务器：

    use admin
    db.shutdownServer()
  2. Restart the server.重新启动服务器。

  3. Use the rs.status() method to determine the member state:使用rs.status()方法确定成员状态：

    rs.status().members
  4. Wait for the stateStr field for this member to show a value of SECONDARY, then restart the next secondary.等待此成员的stateStr字段显示SECONDARY值，然后重新启动下一个辅助。

Secondary servers in the replica set now accept peer connections from members using certificates with the new DN attributes.副本集中的辅助服务器现在使用具有新DN属性的证书接受来自成员的对等连接。

3

Restart Primary Cluster Member重新启动主群集成员

Restart the primary member:重新启动主成员：

  1. Connect to the primary using mongosh, then use the rs.stepDown() method to step the member down as the primary:使用mongosh连接到主节点，然后使用rs.stepDown()方法将该成员降级为主节点：

    rs.stepDown()

    The cluster promotes a secondary with the new certificate to serve as the new primary.集群使用新证书升级次要证书作为新的主要证书。

  2. Use the db.shutdownServer() method to shut the server down:使用db.shutdownServer()方法关闭服务器：

    use admin
    db.shutdownServer()
  3. Restart the server.

The primary server in the replica set steps down and restarts as a secondary that now accepts peer connections from members using certificates with the new DN attributes.副本集中的主服务器会关闭并作为次服务器重新启动，次服务器现在使用具有新DN属性的证书接受来自成员的对等连接。

4

Update the TLS Certificates更新TLS证书

Update the configuration file of each server:更新每台服务器的配置文件：

For example:例如：

net:
  tls:
    mode:               requireTLS
    certificateKeyFile: /etc/mycerts/mongodb-server2.pem
    CAFile:             /etc/mycerts/ca.pem
    clusterFile:        /etc/mycerts/mongodb-cluster2.pem
    clusterCAFile:      /etc/mycerts/ca.pem
    clusterAuthX509:
       attributes:      O=MongoDB, OU=MongoDB Server
security:
  clusterAuthMode: x509
setParameter:
   tlsClusterAuthX509Override: { attributes: O=10gen, OU=10gen Server }
5

Restart Secondary Cluster Members重新启动辅助群集成员

Restart each secondary cluster member:重新启动每个次群集成员：

  1. Use mongosh to connect to each secondary cluster member, then use the db.shutdownServer() method to stop the server:使用mongosh连接到每个辅助集群成员，然后使用db.shutdownServer()方法停止服务器：

    use admin
    db.shutdownServer()
  2. Restart the server.重新启动服务器。

  3. Use the rs.status() method to determine the member state:使用rs.status()方法确定成员状态：

    rs.status().members
  4. Wait for the stateStr field for this member to show a value of SECONDARY, then restart the next secondary.等待此成员的stateStr字段显示SECONDARY值，然后重新启动下一个辅助。

Secondary servers in the replica set now use the new X.509 certificates.副本集中的辅助服务器现在使用新的X.509证书。

6

Restart Primary Cluster Member重新启动主群集成员

Restart the primary member:重新启动主成员：

  1. Connect to the primary using mongosh, then use the rs.stepDown() method to step the member down as the primary:使用mongosh连接到主节点，然后使用rs.stepDown()方法将该成员降级为主节点：

    rs.stepDown()

    The cluster promotes a secondary with the new certificate to serve as the new primary.集群使用新证书升级次要证书作为新的主要证书。

  2. Use the db.shutdownServer() method to shut the server down:使用db.shutdownServer()方法关闭服务器：

    use admin
    db.shutdownServer()
  3. Restart the server.重新启动服务器。

The primary server in the replica set steps down and restarts as a secondary that uses the new X.509 certificate.副本集中的主服务器会关闭并作为使用新X.509证书的辅助服务器重新启动。

7

Remove the DN Certification Override Configuration删除DN证书覆盖配置

With all members of the cluster now using the new X.509 certificate, update the configuration file to remove the setParameter settings for the tlsClusterAuthX509Override parameter.由于集群的所有成员现在都使用了新的X.509证书，请更新配置文件以删除tlsClusterAuthX509Override参数的setParameter设置。

For example:例如：

net:
  tls:
    mode:               requireTLS
    certificateKeyFile: /etc/mycerts/mongodb-server1.pem
    CAFile:             /etc/mycerts/ca.pem
    clusterFile:        /etc/mycerts/mongodb-cluster1.pem
    clusterCAFile:      /etc/mycerts/ca.pem
    clusterAuthX509:
       attributes:      O=MongoDB, OU=MongoDB Server
security:
  clusterAuthMode: x509

This ensures that the server doesn't configure the old certificate settings on startup.这可确保服务器在启动时不会配置旧的证书设置。

8

Restart Secondary Cluster Members重新启动辅助群集成员

Restart each secondary cluster member:重新启动每个次群集成员：

  1. Use mongosh to connect to each secondary cluster member, then use the db.shutdownServer() method to stop the server:使用mongosh连接到每个辅助集群成员，然后使用db.shutdownServer()方法停止服务器：

    use admin
    db.shutdownServer()
  2. Restart the server.重新启动服务器。

  3. Use the rs.status() method to determine the member state:使用rs.status()方法确定成员状态：

    rs.status().members
  4. Wait for the stateStr field for this member to show a value of SECONDARY, then restart the next secondary.等待此成员的stateStr字段显示SECONDARY值，然后重新启动下一个辅助。

Secondary servers in the replica set restart and no longer accept connections from the old X.509 certificates.副本集中的辅助服务器重新启动，不再接受来自旧X.509证书的连接。

9

Restart Primary Cluster Member重新启动主群集成员

Restart the primary member:重新启动主成员：

  1. Connect to the primary using mongosh, then use the rs.stepDown() method to step the member down as the primary:使用mongosh连接到主节点，然后使用rs.stepDown()方法将该成员降级为主节点：

    rs.stepDown()

    The cluster promotes a secondary with the new certificate to serve as the new primary.集群使用新证书升级次要证书作为新的主要证书。

  2. Use the db.shutdownServer() method to shut the server down:使用db.shutdownServer()方法关闭服务器：

    use admin
    db.shutdownServer()
  3. Restart the server.重新启动服务器。

The primary server steps down and restarts as a secondary that no longer accepts connections from the old X.509 certificates.主服务器停止运行，并作为不再接受旧X.509证书连接的辅助服务器重新启动。

Learn More了解更多