Rotate X.509 Certificates without clusterAuthX509 Attributes on Self-Managed Clusters在自我管理集群上旋转不带clusterAuthX509属性的X.509证书
Members of a replica set or a sharded cluster can use X.509 certificates for membership authentication to identify other servers in the same deployment. 副本集或分片集群的成员可以使用X.509证书进行成员身份验证，以识别同一部署中的其他服务器。This tutorial describes how to perform a rolling update to rotate X.509 certificates on a cluster that doesn't use the 本教程介绍如何在不使用net.tls.clusterAuthX509 settings to configure Distinguished Name (DN) attributes.net.tls.clusterAuthX509设置配置可分辨名称（DN）属性的集群上执行滚动更新以轮换X.509证书。
Note
To perform a rolling update to rotate certificates on a cluster that uses the 要执行滚动更新以在使用net.tls.clusterAuthX509 settings or on a cluster that will use these settings after the update, see Rotate X.509 Certificates with clusterAuthX509 Attributes on Self-Managed Clusters.net.tls.clusterAuthX509设置的群集上或在更新后将使用这些设置的群集中轮换证书，请参阅在自我管理群集上使用clusterAuthX508属性旋转X.509证书。
When a server node receives a connection request, it compares the Distinguished Name (DN) attributes in the 当服务器节点收到连接请求时，它会将所提供证书的subject field of the presented certificates to the subject DN attributes of its own certificates. subject字段中的可分辨名称（DN）属性与其自己的证书的主题DN属性进行比较。The certificates match if their subjects contain the same values for the Organization (如果证书的主题包含组织（O), Organizational Unit (OU), and Domain Component (DC) attributes. O）、组织单位（OU）和域组件（DC）属性的相同值，则证书匹配。A server's configuration file can also specify alternative DN attributes to use for matching in the 服务器的配置文件还可以指定用于在tlsX509ClusterAuthDNOverride parameter. tlsX509ClusterAuthDNOverride参数中进行匹配的替代DN属性。If the server's subject DN attributes or configured 如果服务器的主题DN属性或配置的tlsX509ClusterAuthDNOverride value match the subject DN attributes of the presented certificate, the server node treats the connection as a cluster member.tlsX509ClusterAuthDNOverride值与所提供证书的主题DN特性匹配，则服务器节点将该连接视为群集成员。
In some situations, you may need to update the member certificates to new certificates with new subject Distinguished Name (DN) attributes, such as if an organization changes its name. In a rolling update, member certificates are updated one at a time, and your deployment does not incur any downtime.在某些情况下，您可能需要将成员证书更新为具有新主题可分辨名称（DN）属性的新证书，例如如果组织更改了名称。在滚动更新中，成员证书一次更新一个，部署不会导致任何停机。
Clusters adopting new certificates can use the 采用新证书的群集可以在证书轮换过程中使用tlsX509ClusterAuthDNOverride parameter to accept x.509 certificates with different subject DN attributes during the certificate rotation procedure. tlsX509ClusterAuthDNOverride参数接受具有不同主题DN属性的x.509证书。Once all members use certificates with the new value, remove the override to begin rejecting the now out of date certificates.一旦所有成员使用具有新值的证书，请删除覆盖以开始拒绝现已过期的证书。
About This Task关于此任务
Consider a replica set where each member's X.509 certificates, set using the 考虑一个副本集，其中每个成员的X.509证书（使用clusterFile and certificateKeyFile settings, have subject DN attributes of "OU=10gen Server,O=10gen".clusterFile和certificateKeyFile设置设置）的主题DN属性为"OU=10gen Server,O=10gen"。
A member of this replica set has the following configuration file:此副本集的成员具有以下配置文件：
net.tls.mode: requireTLS
net.tls.certificateKeyFile: "./mycerts/10gen-server1.pem"
net.tls.CAFile: "./mycerts/ca.pem"
security.clusterAuthMode: x509
net.tls.clusterFile: "./mycerts/10gen-cluster1.pem"
net.tls.clusterCAFile: "./mycerts/ca.pem"The following procedure updates each member's certificates to new certificates that have subject DN attributes of 以下过程将每个成员的证书更新为具有主题DN属性"OU=MongoDB Server, O=MongoDB"."OU=MongoDB Server, O=MongoDB"的新证书。
Note
The following procedure assumes that the new X.509 certificates meet membership certificate and all other requirements and that the cluster configuration identifies peer certificates using Distinguished Name (DN) values. 以下过程假设新的X.509证书满足成员证书和所有其他要求，并且集群配置使用可分辨名称（DN）值标识对等证书。For more information, see Member Certificate Requirements.有关更多信息，请参阅会员证书要求。
Steps步骤
Set override parameter on all members.在所有成员上设置覆盖参数。
During a rolling update, members are restarted one at a time with a new configuration. To allow server nodes with the the old subject DN attributes to identify nodes with the new subject DN attributes as cluster members, set the override parameter to the new subject DN attributes on all running members.在滚动更新期间，使用新配置一次重新启动一个成员。若要允许具有旧主题DN属性的服务器节点将具有新主题DN特性的节点标识为集群成员，请将覆盖参数设置为所有运行成员上的新主题DN属性。
To do this, modify the configuration file of each server to set the 为此，请修改每个服务器的配置文件，将tlsX509ClusterAuthDNOverride parameter to use the subject DN attributes of the new certificate:tlsX509ClusterAuthDNOverride参数设置为使用新证书的主题DN属性：
net.tls.mode: requireTLS
net.tls.certificateKeyFile: "./mycerts/10gen-server1.pem"
net.tls.CAFile: "./mycerts/ca.pem"
security.clusterAuthMode: x509
net.tls.clusterFile: "./mycerts/10gen-cluster1.pem"
net.tls.clusterCAFile: "./mycerts/ca.pem"
setParameter:
tlsX509ClusterAuthDNOverride: "OU=MongoDB Server,O=MongoDB"This configuration will not be taken into consideration until you restart each member.在重新启动每个成员之前，不会考虑此配置。
Restart all members.重新启动所有成员。
To perform a rolling restart of all members, restart each secondary and then the primary.要对所有成员执行滚动重新启动，请重新启动每个次要成员，然后重新启动主要成员。
For each secondary member, connect 对于每个次要成员，将mongosh to the member, then:mongosh连接到该成员，然后：
Use the使用db.shutdownServer()method to shut down the member:db.shutdownServer()方法关闭成员：use admin
db.shutdownServer()Restart the member.重新启动成员。Before restarting the next secondary, ensure this member has reached在重新启动下一个辅助设备之前，请确保此成员已达到SECONDARYstate.SECONDARY状态。To determine the member state, run要确定成员状态，请运行rs.status()and read the value of thestateStrfield.rs.status()并读取stateStr字段的值。rs.status().members
For the primary member, connect 对于主要成员，将mongosh to the member, then:mongosh连接到该成员，然后：
Use使用rs.stepDown()to step down the member:rs.stepDown()来降低成员的级别：rs.stepDown()Use the使用db.shutdownServer()method to shut down the member:db.shutdownServer()方法关闭成员：use admin
db.shutdownServer()Restart the member.重新启动成员。
All servers in the replica set can now use the override parameter to accept peer connections from members using certificates with the new subject DN attributes.副本集中的所有服务器现在都可以使用覆盖参数来接受来自使用具有新主题DN属性的证书的成员的对等连接。
Modify configuration of all members.修改所有成员的配置。
Update the configuration file of each server:更新每台服务器的配置文件：
Change the将net.tls.certificateKeyFilesetting to the new certificate.net.tls.certificateKeyFile设置更改为新证书。Change the将net.tls.clusterFilesetting to the new certificate.net.tls.clusterFile设置更改为新证书。Set the设置tlsX509ClusterAuthDNOverrideparameter to use the DN attributes of the old certificate.tlsX509ClusterAuthDNOverride参数以使用旧证书的DN属性。
For example:例如：
net.tls.mode: requireTLS
net.tls.certificateKeyFile: "./mycerts/mongodb-server1.pem"
net.tls.CAFile: "./mycerts/ca.pem"
security.clusterAuthMode: x509
net.tls.clusterFile: "./mycerts/mongodb-cluster1.pem"
net.tls.clusterCAFile: "./mycerts/ca.pem"
setParameter:
tlsX509ClusterAuthDNOverride: "OU=10Gen Server,O=10Gen"This configuration will not be taken into consideration until you restart each member.在重新启动每个成员之前，不会考虑此配置。
Restart all members.重新启动所有成员。
To apply the updated configuration to each member, perform a rolling restart of the server nodes by repeating the procedure from step 2.要将更新的配置应用于每个成员，请通过重复步骤2的过程来执行服务器节点的滚动重启。
During this process, nodes that have been restarted with new certificates will use the old DN attributes stored in 在此过程中，使用新证书重新启动的节点将使用存储在tlsX509ClusterAuthDNOverride to identify nodes presenting old certificates. tlsX509ClusterAuthDNOverride中的旧DN属性来标识提供旧证书的节点。Nodes that still have old certificates will use the new DN stored in 仍具有旧证书的节点将使用tlsX509ClusterAuthDNOverride to identify nodes presenting new certificates.tlsX509ClusterAuthDNOverride中存储的新DN来标识提供新证书的节点。
Remove override parameter from all members.从所有成员中删除覆盖参数。
To prevent the updated server nodes from treating clients presenting the old certificate as peers, remove the 为了防止更新的服务器节点将提供旧证书的客户端视为对等体，请从所有服务器节点配置文件中删除tlsX509ClusterAuthDNOverride parameter from all server node configuration files.tlsX509ClusterAuthDNOverride参数。
For example:例如：
net.tls.mode: requireTLS
net.tls.certificateKeyFile: "./mycerts/mongodb-server1.pem"
net.tls.CAFile: "./mycerts/ca.pem"
security.clusterAuthMode: x509
net.tls.clusterFile: "./mycerts/mongodb-cluster1.pem"
net.tls.clusterCAFile: "./mycerts/ca.pem"This configuration will not be taken into consideration until you restart each member.在重新启动每个成员之前，不会考虑此配置。
Restart all members.重新启动所有成员。
To apply the updated configuration to each member, perform a rolling restart of the server nodes by repeating the procedure from step 2.要将更新的配置应用于每个成员，请通过重复步骤2的过程来执行服务器节点的滚动重启。
All servers in the replica set now accept peer connections only from members using certificates that have the new subject DN attributes.副本集中的所有服务器现在只接受来自使用具有新主题DN属性的证书的成员的对等连接。