Database Manual / Security / Encryption / TLS/SSL

Upgrade a Cluster to Use TLS/SSL升级群集以使用TLS/SSL

The MongoDB server supports listening for both TLS/SSL encrypted and unencrypted connections on the same TCP port. This allows upgrades of MongoDB clusters to use TLS/SSL encrypted connections.MongoDB服务器支持在同一TCP端口上监听TLS/SSL加密和未加密的连接。这允许升级MongoDB集群以使用TLS/SSL编码的连接。

Note

MongoDB disables support for TLS 1.0 encryption on systems where TLS 1.1+ is available.MongoDB在TLS 1.1+可用的系统上禁用对TLS 1.0加密的支持。

Procedure (Using tls Settings)程序（使用tls设置）

Important

A full description of TLS/SSL, PKI (Public Key Infrastructure) certificates, and Certificate Authority is beyond the scope of this document. This page assumes prior knowledge of TLS/SSL as well as access to valid certificates.TLS/SSL、PKI（公钥基础设施）证书和证书颁发机构的完整描述超出了本文档的范围。本页假设您已具备TLS/SSL的先验知识以及有效证书的访问权限。

To upgrade from a MongoDB cluster using no TLS/SSL encryption to one using only TLS/SSL encryption, use the following rolling upgrade process.要从不使用TLS/SSL加密的MongoDB集群升级到仅使用TLS/SSL加密的集群，请使用以下滚动升级过程。

Note

The procedures in this section use the tls settings/option. For procedures using their ssl aliases, see Procedure (Using ssl Settings).本节中的过程使用tls设置/选项。有关使用ssl别名的过程，请参阅过程（使用ssl设置）。

The tls settings/options provide identical functionality as the ssl options since MongoDB has always supported TLS 1.0 and later.tls设置/选项提供与ssl选项相同的功能，因为MongoDB一直支持tls 1.0及更高版本。

  1. For each node of a cluster, start the node with the command-line option --tlsMode or the configuration file option net.tls.mode set to allowTLS. 对于集群的每个节点，使用命令行选项--tlsMode或配置文件选项net.tls.mode设置为allowTLS来启动节点。The allowTLS setting allows the node to accept both TLS/SSL and non-TLS/non-SSL incoming connections. allowTLS设置允许节点接受TLS/SSL和非TLS/非SSL传入连接。Its connections to other servers do not use TLS/SSL. Include other TLS/SSL options 它与其他服务器的连接不使用TLS/SSL。包括其他TLS/SSL选项[2] as well as any other options that are required for your specific configuration.以及特定配置所需的任何其他选项。

    Note

    mongod and mongos bind to localhost by default. mongod和mongos默认绑定到localhost。If the members of your deployment are run on different hosts or if you wish remote clients to connect to your deployment, you must specify --bind_ip or net.bindIp.如果部署的成员在不同的主机上运行，或者希望远程客户端连接到部署，则必须指定--bind_ip或net.bindIp。

    For example:例如：

    mongod --replSet <name> --tlsMode allowTLS --tlsCertificateKeyFile <TLS/SSL certificate and key file> --tlsCAFile <path to root CA PEM file> <additional options>

    To specify these options in the configuration file, include the following settings in the file:要在配置文件中指定这些选项，请在文件中包含以下设置：

    net:
       tls:
          mode: allowTLS
          certificateKeyFile: <path to TLS/SSL certificate and key PEM file>
          CAFile: <path to root CA PEM file>

    Upgrade all nodes of the cluster to these settings.将群集的所有节点升级到这些设置。

  2. Switch all clients to use TLS/SSL. See TLS/SSL Configuration for Clients.将所有客户端切换为使用TLS/SSL。请参阅客户端的TLS/SSL配置。

  3. For each node of a cluster, use the setParameter command to update the tlsMode to preferTLS. 对于集群的每个节点，使用setParameter命令将tlsMode更新为preferTLS。[1] With preferTLS as its net.tls.mode, the node accepts both TLS/SSL and non-TLS/non-SSL incoming connections, and its connections to other servers use TLS/SSL. For example:使用preferTLS作为其net.tls.mode，节点接受TLS/SSL和非TLS/非SSL传入连接，并且其与其他服务器的连接使用TLS/SSL。例如：

    db.adminCommand( { setParameter: 1, tlsMode: "preferTLS" } )

    Upgrade all nodes of the cluster to these settings.将群集的所有节点升级到这些设置。

    At this point, all connections should be using TLS/SSL.此时，所有连接都应该使用TLS/SSL。

  4. For each node of the cluster, use the setParameter command to update the tlsMode to requireTLS. 对于集群的每个节点，使用setParameter命令将tlsMode更新为requireTLS。[1] With requireTLS as its net.tls.mode, the node will reject any non-TLS/non-SSL connections. For example:使用requireTLS作为其net.tls.mode，节点将拒绝任何非TLS/非SSL连接。例如：

    db.adminCommand( { setParameter: 1, tlsMode: "requireTLS" } )
  5. After the upgrade of all nodes, edit the configuration file with the appropriate TLS/SSL settings to ensure that upon subsequent restarts, the cluster uses TLS/SSL.升级所有节点后，使用适当的TLS/SSL设置编辑配置文件，以确保在后续重新启动时，集群使用TLS/SSL。

Procedure (Using ssl Settings)过程（使用ssl设置）

Important

A full description of TLS/SSL, PKI (Public Key Infrastructure) certificates, and Certificate Authority is beyond the scope of this document. This page assumes prior knowledge of TLS/SSL as well as access to valid certificates.TLS/SSL、PKI（公钥基础设施）证书和证书颁发机构的完整描述超出了本文档的范围。本页假设您已具备TLS/SSL的先验知识以及有效证书的访问权限。

To upgrade from a MongoDB cluster using no TLS/SSL encryption to one using only TLS/SSL encryption, use the following rolling upgrade process.要从不使用TLS/SSL加密的MongoDB集群升级到仅使用TLS/SSL加密的集群，请使用以下滚动升级过程。

Note

The procedures in this section use the ssl settings/option. For procedures using their tls aliases, see Procedure (Using tls Settings).本节中的过程使用ssl设置/选项。有关使用tls别名的过程，请参阅过程（使用tls设置）。

The tls settings/options provide identical functionality as the ssl options since MongoDB has always supported TLS 1.0 and later.tls设置/选项提供与ssl选项相同的功能，因为MongoDB一直支持tls 1.0及更高版本。

  1. For each node of a cluster, start the node with the command-line option --sslMode or the configuration file option net.ssl.mode set to allowSSL. 对于集群的每个节点，使用命令行选项--sslMode或配置文件选项net.ssl.mode设置为allowSSL来启动节点。The allowSSL setting allows the node to accept both TLS/SSL and non-TLS/non-SSL incoming connections. allowSSL设置允许节点接受TLS/SSL和非TLS/非SSL传入连接。Its connections to other servers do not use TLS/SSL. 它与其他服务器的连接不使用TLS/SSL。Include other TLS/SSL options [2] as well as any other options that are required for your specific configuration.包括其他TLS/SSL选项TLS/SSL options [2]以及特定配置所需的任何其他选项。

    Note

    mongod and mongos bind to localhost by default. mongod和mongos默认绑定到localhost。If the members of your deployment are run on different hosts or if you wish remote clients to connect to your deployment, you must specify --bind_ip or net.bindIp.如果部署的成员在不同的主机上运行，或者希望远程客户端连接到部署，则必须指定--bind_ip或net.bindIp。

    For example:例如：

    mongod --replSet <name> --sslMode allowSSL --sslPEMKeyFile <path to TLS/SSL Certificate and key PEM file> --sslCAFile <path to root CA PEM file> <additional options>

    To specify these options in the configuration file, include the following settings in the file:要在配置文件中指定这些选项，请在文件中包含以下设置：

    net:
       ssl:
          mode: <allowSSL>
          PEMKeyFile: <path to TLS/SSL certificate and key PEM file>
          CAFile: <path to root CA PEM file>

    Upgrade all nodes of the cluster to these settings.将群集的所有节点升级到这些设置。

  2. Switch all clients to use TLS/SSL. See TLS/SSL Configuration for Clients.将所有客户端切换为使用TLS/SSL。请参阅客户端的TLS/SSL配置。

  3. For each node of a cluster, use the setParameter command to update the sslMode to preferSSL. 对于集群的每个节点，使用setParameter命令将sslMode更新为preferSSL。[1] With preferSSL as its net.ssl.mode, the node accepts both TLS/SSL and non-TLS/non-SSL incoming connections, and its connections to other servers use TLS/SSL. For example:使用preferSSL作为其net.ssl.mode，节点接受TLS/SSL和非TLS/非SSL传入连接，并且其与其他服务器的连接使用TLS/SSL。例如：

    db.adminCommand( { setParameter: 1, sslMode: "preferSSL" } )

    Upgrade all nodes of the cluster to these settings.将群集的所有节点升级到这些设置。

    At this point, all connections should be using TLS/SSL.此时，所有连接都应该使用TLS/SSL。

  4. For each node of the cluster, use the setParameter command to update the sslMode to requireSSL. 对于集群的每个节点，使用setParameter命令将sslMode更新为requireSSL。[1] With requireSSL as its net.ssl.mode, the node rejects any non-TLS/non-SSL connections. For example:使用requireSSL作为其net.ssl.mode，节点拒绝任何非TLS/非SSL连接。例如：

    db.adminCommand( { setParameter: 1, sslMode: "requireSSL" } )
  5. After the upgrade of all nodes, edit the configuration file with the appropriate TLS/SSL settings to ensure that upon subsequent restarts, the cluster uses TLS/SSL.升级所有节点后，使用适当的TLS/SSL设置编辑配置文件，以确保在后续重新启动时，集群使用TLS/SSL。
[1](1, 2, 3, 4) As an alternative to using the setParameter command, you can also restart the nodes with the appropriate TLS/SSL options and values.作为使用setParameter命令的替代方法，您还可以使用适当的TLS/SSL选项和值重新启动节点。
[2](1, 2) You can use system SSL certificate stores for Windows and macOS. 您可以使用Windows和macOS的系统SSL证书存储。To use the system SSL certificate store, use: 要使用系统SSL证书存储，请使用：
  • net.tls.certificateSelector (or the command-line option --tlsCertificateSelector) instead of （或命令行选项--tlsCertificateSelector）而不是net.tls.certificateKeyFile (or the command-line option``--certificateKeyFile``).（或命令行选项--certificateKeyFile）。
  • net.ssl.certificateSelector (or the command-line option --sslCertificateSelector) instead of （或命令行选项--sslCertificateSelector）而不是net.ssl.PEMKeyFile (or the command-line option``--sslPEMKeyFile``).（或命令行选项--sslPEMKeyFile）
When using the system SSL certificate store, OCSP (Online Certificate Status Protocol) is used to validate the revocation status of certificates.使用系统SSL证书存储时，OCSP（在线证书状态协议）用于验证证书的吊销状态。