Database Manual / Self-Managed Deployments / Security / Authentication / Internal

Rotate X.509 Certificates to Use Extension Values on Self-Managed Clusters在自我管理集群上旋转X.509证书以使用扩展值

New in version 7.0.在版本7.0中新增。

Cluster members can use X.509 certificates for membership authentication to identify other servers in the same deployment. 集群成员可以使用X.509证书进行成员身份验证，以识别同一部署中的其他服务器。This tutorial describes how to perform a rolling update to migrate from using certificate Distinguished Name (DN) attributes to using extension values to identify members of a cluster.本教程介绍如何执行滚动更新，以从使用证书可分辨名称（DN）属性迁移到使用扩展值来标识集群成员。

When a server configured with the net.tls.clusterAuthX509.extensionValue setting receives a connection request, it compares the the extension value string of the presented certificates to the configured values of the extensionValue setting and tlsClusterAuthX509Override parameter. If the values match, it treats the connection as a cluster member.当配置了net.tls.clusterAuthX509.extensionValue设置的服务器收到连接请求时，它会将所提供证书的扩展值字符串与extensionValue设置和tlsClusterAuthX509Override参数的配置值进行比较。如果值匹配，则将连接视为集群成员。

Clusters adopting new certificates can use the tlsClusterAuthX509Override parameter to accept X.509 certificates with different DN attributes during the certificate rotation procedure. Once all members use certificates with the new value, remove the override to begin rejecting the now out of date certificates.采用新证书的群集可以在证书轮换过程中使用tlsClusterAuthX509Override参数接受具有不同DN属性的X.509证书。一旦所有成员使用具有新值的证书，请删除覆盖以开始拒绝现已过期的证书。

About This Task关于此任务

Consider a replica set where member certificates, set using the clusterFile and certificateKeyFile settings, have Distinguished Name (DN) attributes that use the MongoDB organization and MongoDB Server organizational unit. 考虑一个副本集，其中使用clusterFile和certificateKeyFile设置设置的成员证书具有使用MongoDB组织和MongoDB Server组织单位的可分辨名称（DN）属性。These DN attributes are set using the net.tls.clusterAuthX509.attributes setting.这些DN属性是使用net.tls.clusterAuthX509.attributes属性设置设置的。

security:
  clusterAuthMode:      x509
net:
  tls:
    mode:               requireTLS
    certificateKeyFile: /etc/mycerts/10gen-server1.pem
    CAFile:             /etc/mycerts/ca.pem
    clusterFile:        /etc/mycerts/10gen-cluster1.pem
    clusterCAFile:      /etc/mycerts/ca.pem
    clusterAuthX509:
       attributes:      O=MongoDB, OU=MongoDB Server

Note

The following procedure assumes that the new X.509 certificates meet membership certificate and all other requirements and that the cluster configuration identifies peer certificates using Distinguished Name (DN) values. 以下过程假设新的X.509证书满足成员证书和所有其他要求，并且集群配置使用可分辨名称（DN）值标识对等证书。For more information, see Member Certificate Requirements.有关更多信息，请参阅会员证书要求。

Steps步骤

These steps update member certificates to use new X.509 certificates on a cluster configured with the attributes setting.这些步骤更新成员证书，以便在配置了attributes设置的集群上使用新的X.509证书。

Initially, the clusters identify members using DN values. With the new certificates, the servers instead identify members using the mongodb://example.mongodb.net extension value and ignore certificate attributes.最初，集群使用DN值标识成员。使用新证书，服务器将使用mongodb://example.mongodb.net扩展值，忽略证书属性。

1

Update the TLS Cluster Membership Configuration更新TLS群集成员资格配置

Update the configuration file of each server:更新每台服务器的配置文件：

For example:例如：

net:
  tls:
    mode:               requireTLS
    certificateKeyFile: /etc/mycerts/mongodb-server1.pem
    CAFile:             /etc/mycerts/ca.pem
    clusterFile:        /etc/mycerts/mongodb-cluster1.pem
    clusterCAFile:      /etc/mycerts/ca.pem
    clusterAuthX509:
       extensionValue:  mongodb://example.mongodb.net
security:
  clusterAuthMode: x509
setParameter:
   tlsClusterAuthX509Override: "{ attributes: 'O=MongoDB, OU=MongoDB Server' }"
2

Restart Secondary Cluster Members重新启动辅助群集成员

Restart each secondary cluster member:重新启动每个次群集成员：

  1. Use mongosh to connect to each secondary cluster member, then use the db.shutdownServer() method to stop the server:使用mongosh连接到每个辅助集群成员，然后使用db.shutdownServer()方法停止服务器：

    use admin
    db.shutdownServer()
  2. Restart the server.重新启动服务器。

  3. Use the rs.status() method to determine the member state:使用rs.status()方法确定成员状态：

    rs.status().members
  4. Wait for the stateStr field for this member to show a value of SECONDARY, then restart the next secondary.等待此成员的stateStr字段显示SECONDARY值，然后重新启动下一个辅助。

Secondary servers in the replica set now accept peer connections from members using certificates with the new extension values as well as the old DN attributes.副本集中的辅助服务器现在使用具有新扩展值和旧DN属性的证书接受来自成员的对等连接。

3

Restart Primary Cluster Member重新启动主群集成员

Restart the primary member:重新启动主成员：

  1. Connect to the primary using mongosh, then use the rs.stepDown() method to step the member down as the primary:使用mongosh连接到主节点，然后使用rs.stepDown()方法将该成员降级为主节点：

    rs.stepDown()

    The cluster promotes a secondary with the new certificate to serve as the new primary.集群使用新证书升级次要证书作为新的主要证书。

  2. Use the db.shutdownServer() method to shut the server down:使用db.shutdownServer()方法关闭服务器：

    use admin
    db.shutdownServer()
  3. Restart the server.重新启动服务器。

The primary server in the replica set steps down and restarts as a secondary that now accepts peer connections from members using certificates with the new extension value as well as the old DN attributes.副本集中的主服务器会关闭并作为辅助服务器重新启动，该辅助服务器现在使用具有新扩展值和旧DN属性的证书接受来自成员的对等连接。

4

Update the TLS Certificates更新TLS证书

Update the configuration file of each server:更新每台服务器的配置文件：

For example:例如：

net:
  tls:
    mode:               requireTLS
    certificateKeyFile: /etc/mycerts/mongodb-server2.pem
    CAFile:             /etc/mycerts/ca.pem
    clusterFile:        /etc/mycerts/mongodb-cluster2.pem
    clusterCAFile:      /etc/mycerts/ca.pem
    clusterAuthX509:
       extensionValue:  mongodb://example.mongodb.net
security:
  clusterAuthMode: x509
setParameter:
   tlsClusterAuthX509Override: "{ attributes: 'O=MongoDB, OU=MongoDB Server' }"
5

Restart Secondary Cluster Members重新启动辅助群集成员

Restart each secondary cluster member:重新启动每个次群集成员：

  1. Use mongosh to connect to each secondary cluster member, then use the db.shutdownServer() method to stop the server:使用mongosh连接到每个辅助集群成员，然后使用db.shutdownServer()方法停止服务器：

    use admin
    db.shutdownServer()
  2. Restart the server.重新启动服务器。

  3. Use the rs.status() method to determine the member state:使用rs.status()方法确定成员状态：

    rs.status().members
  4. Wait for the stateStr field for this member to show a value of SECONDARY, then restart the next secondary.等待此成员的stateStr字段显示SECONDARY值，然后重新启动下一个辅助。

Secondary servers in the replica set now use the new X.509 certificates.副本集中的辅助服务器现在使用新的X.509证书。

6

Restart Primary Cluster Member重新启动主群集成员

Restart the primary member:重新启动主成员：

  1. Connect to the primary using mongosh, then use the rs.stepDown() method to step the member down as the primary:使用mongosh连接到主节点，然后使用rs.stepDown()方法将该成员降级为主节点：

    rs.stepDown()

    The cluster promotes a secondary with the new certificate to serve as the new primary.集群使用新证书升级次要证书作为新的主要证书。

  2. Use the db.shutdownServer() method to shut the server down:使用db.shutdownServer()方法关闭服务器：

    use admin
    db.shutdownServer()
  3. Restart the server.重新启动服务器。

The primary server in the replica set steps down and restarts as a secondary that uses the new X.509 certificate.副本集中的主服务器会关闭并作为使用新X.509证书的辅助服务器重新启动。

7

Remove the DN Certification Override Configuration删除DN证书覆盖配置

With all members of the cluster now using the new X.509 certificate, update the configuration file to remove the setParameter settings for the tlsClusterAuthX509Override parameter.由于集群的所有成员现在都使用了新的X.509证书，请更新配置文件以删除tlsClusterAuthX509Override参数的setParameter设置。

For example:例如：

net:
  tls:
    mode:               requireTLS
    certificateKeyFile: /etc/mycerts/mongodb-server1.pem
    CAFile:             /etc/mycerts/ca.pem
    clusterFile:        /etc/mycerts/mongodb-cluster1.pem
    clusterCAFile:      /etc/mycerts/ca.pem
    clusterAuthX509:
       extensionValue:  mongodb://example.mongodb.net
security:
  clusterAuthMode: x509

This ensures that the server doesn't configure the old certificate settings on startup.这可确保服务器在启动时不会配置旧的证书设置。

8

Restart Secondary Cluster Members重新启动辅助群集成员

Restart each secondary cluster member:重新启动每个次群集成员：

  1. Use mongosh to connect to each secondary cluster member, then use the db.shutdownServer() method to stop the server:使用mongosh连接到每个辅助集群成员，然后使用db.shutdownServer()方法停止服务器：

    use admin
    db.shutdownServer()
  2. Restart the server.重新启动服务器。

  3. Use the rs.status() method to determine the member state:使用rs.status()方法确定成员状态：

    rs.status().members
  4. Wait for the stateStr field for this member to show a value of SECONDARY, then restart the next secondary.等待此成员的stateStr字段显示SECONDARY值，然后重新启动下一个辅助。

Secondary servers in the replica set restart and no longer accept connections from the old X.509 certificates.副本集中的辅助服务器重新启动，不再接受来自旧X.509证书的连接。

9

Restart Primary Cluster Member重新启动主群集成员

Restart the primary member:重新启动主成员：

  1. Connect to the primary using mongosh, then use the rs.stepDown() method to step the member down as the primary:使用mongosh连接到主节点，然后使用rs.stepDown()方法将该成员降级为主节点：

    rs.stepDown()

    The cluster promotes a secondary with the new certificate to serve as the new primary.集群使用新证书升级次要证书作为新的主要证书。

  2. Use the db.shutdownServer() method to shut the server down:使用db.shutdownServer()方法关闭服务器：

    use admin
    db.shutdownServer()
  3. Restart the server.重新启动服务器。

The primary server steps down and restarts as a secondary that no longer accepts connections from the old X.509 certificates.主服务器停止运行，并作为不再接受旧X.509证书连接的辅助服务器重新启动。

Learn More了解更多