Upgrade Self-Managed MongoDB from Keyfile Authentication to X.509 Authentication将自管理MongoDB从键文件身份验证升级到X.509身份验证

Upgrade (Using tls Options) Clusters Using TLS/SSL and Keyfile使用tls/SSL和键文件升级（使用tls选项）群集

For clusters using TLS/SSL and keyfile authentication, to upgrade to X.509 cluster authentication, use the following rolling upgrade process:对于使用TLS/SSL和键文件身份验证的集群，要升级到X.509集群身份验证，请使用以下滚动升级过程：

1. For each member of a cluster, add the following settings to the configuration file and restart:对于集群的每个成员，将以下设置添加到配置文件中并重新启动：

   • security.clusterAuthMode

     Set to sendKeyFile. With this setting value, each node continues to send its keyfile to authenticate itself as a member. However, each node can receive either a keyfile or an X.509 certificate from other members to authenticate those members.设置为sendKeyFile。使用此设置值，每个节点将继续发送其键文件，以验证其作为成员的身份。但是，每个节点都可以从其他成员接收键文件或X.509证书，以对这些成员进行身份验证。

   • net.tls.clusterFile

     Set to the appropriate path of the node's certificate key file for membership authentication. The mongod / mongos presents this file to other members of the cluster to identify itself as a member.设置为节点证书键文件的适当路径以进行成员身份验证。mongod/mongos将此文件呈现给集群的其他成员，以将自己标识为成员。

   Include other TLS/SSL options and any other options as appropriate for your specific configuration.包括其他TLS/SSL选项以及适合您特定配置的任何其他选项。

   For example:例如：

   net:
      tls:
         mode: requireTLS
         certificateKeyFile: /etc/ssl/mongodb.pem
         CAFile: /etc/ssl/caToValidateReceivedCertificates.pem
         clusterFile: "/etc/ssl/myReplMembershipCertificateKeyFile.pem"
   security:
      clusterAuthMode: sendKeyFile
      keyFile: /my/securely/located/membershipkey
   replication:
      replSetName: myReplicaSet
   net:
      bindIp: localhost,mongodb0.example.net
      port: 27017
   systemLog:
      destination: file
      path: "/var/log/mongodb/mongod.log"
      logAppend: true
   storage:
      dbPath: "/var/lib/mongodb"
   processManagement:
      fork: true

   Update all nodes of the cluster to include the security.clusterAuthMode and net.tls.clusterFile settings before continuing.在继续之前，更新集群的所有节点以包含security.clusterAuthMode和net.tls.clusterFile设置。

2. Connect to each node and use the setParameter command to update the clusterAuthMode to sendX509. 连接到每个节点，并使用setParameter命令将clusterAuthMode更新为sendX509。[1]

   db.adminCommand( { setParameter: 1, clusterAuthMode: "sendX509" } )

   With sendX509, each node sends its net.tls.clusterFile to authenticate itself as a member. However, each node can receive either a keyfile or an X.509 certificate from other members to authenticate those members.使用sendX509，每个节点都会发送其net.tls.clusterFile以验证其成员身份。但是，每个节点都可以从其他成员接收键文件或X.509证书，以对这些成员进行身份验证。

   Upgrade all nodes of the cluster to this setting before continuing.在继续之前，请将群集的所有节点升级到此设置。

3. Optional but recommended. 可选，但推荐。Finally, for each node of the cluster, connect to the node and use the setParameter command to update the clusterAuthMode to x509 to only use the X.509 certificate for authentication. 最后，对于集群的每个节点，连接到该节点并使用setParameter命令将clusterAuthMode更新为x509，以便仅使用X.509证书进行身份验证。[1]

   db.adminCommand( { setParameter: 1, clusterAuthMode: "x509" } )

4. After the upgrade of all nodes, edit the configuration file with the appropriate X.509 settings to ensure that upon subsequent restarts, the cluster uses X.509 authentication. For example:升级所有节点后，使用适当的X.509设置编辑配置文件，以确保在后续重新启动时，集群使用X.509身份验证。例如：

   net:
      tls:
         mode: requireTLS
         certificateKeyFile: /etc/ssl/mongodb.pem
         CAFile: /etc/ssl/caToValidateReceivedCertificates.pem
         clusterFile: "/etc/ssl/myReplMembershipCertificateKeyFile.pem"
   security.clusterAuthMode: x509
   replication:
      replSetName: myReplicaSet
   net:
      bindIp: localhost,mongodb0.example.net
      port: 27017
   systemLog:
      destination: file
      path: "/var/log/mongodb/mongod.log"
      logAppend: true
   storage:
      dbPath: "/var/lib/mongodb"
   processManagement:
      fork: true

Update (Using tls Options) Clusters Using Keyfile but Not TLS/SSL使用键文件而非TLS/SSL更新（使用tls选项）群集

For clusters using keyfile authentication but not TLS/SSL, to upgrade to X.509 membership authentication and TLS/SSL connections:对于使用键文件身份验证但不使用TLS/SSL的集群，要升级到X.509成员身份验证和TLS/SSL连接：

1. For each member of a cluster, add the following settings to the configuration file and restart:对于集群的每个成员，将以下设置添加到配置文件中并重新启动：

   • net.tls.mode

     Set to allowTLS. This value allows the node to accept both TLS/SSL and non-TLS/non-SSL incoming connections. Its outgoing connections do not use TLS/SSL.设置为allowTLS。此值允许节点接受TLS/SSL和非TLS/非SSL传入连接。其传出连接不使用TLS/SSL。

   • net.tls.certificateKeyFile

     Set to the path of the file that contains the TLS/SSL certificate and key. The mongod / mongos presents this file to its clients to establish the instance's identity. Required when using TLS/SSL.设置为包含TLS/SSL证书和键的文件的路径。mongod/mongos向其客户端提供此文件以建立实例的身份。使用TLS/SSL时需要。

   • net.tls.clusterFile

     Set to the appropriate path of the node's certificate key file for membership authentication. 设置为节点证书键文件的适当路径以进行成员身份验证。The mongod / mongos presents this file to other members of the cluster to identify itself as a member.mongod/mongos将此文件呈现给集群的其他成员，以将自己标识为成员。

   • net.tls.CAFile

     Set to the path of the file that contains the certificate chain for verifying received certificates.设置为包含证书链的文件的路径，用于验证收到的证书。

   • security.clusterAuthMode

     Set to sendKeyFile. This allows each node continues to send its keyfile to authenticate itself as a member. However, each node can receive either a keyfile or an X.509 certificate from other members to authenticate those members.设置为sendKeyFile。这允许每个节点继续发送其键文件，以验证其作为成员的身份。但是，每个节点都可以从其他成员接收键文件或X.509证书，以对这些成员进行身份验证。

   Include other TLS/SSL options and any other options as appropriate for your specific configuration.包括其他TLS/SSL选项以及适合您特定配置的任何其他选项。

   For example:例如：

   
   
   net:
      tls:
         mode: allowTLS
         certificateKeyFile: /etc/ssl/mongodb.pem
         clusterFile: "/etc/ssl/myReplMembershipCertificateKeyFile.pem"
         CAFile: /etc/ssl/caToValidateReceivedCertificates.pem
   security:
      clusterAuthMode: sendKeyFile
      keyFile: /my/securely/located/membershipkey
   replication:
      replSetName: myReplicaSet
   net:
      bindIp: localhost,mongodb0.example.net
      port: 27017
   systemLog:
      destination: file
      path: "/var/log/mongodb/mongod.log"
      logAppend: true
   storage:
      dbPath: "/var/lib/mongodb"
   processManagement:
      fork: true

   Upgrade all nodes of the cluster to include net.tls.mode, net.tls.certificateKeyFile, net.tls.clusterFile, and security.clusterAuthMode.升级集群的所有节点，使其包含net.tls.mode、net.tls.certificateKeyFile、net.tls.clusterFile和security.clusterAuthMode。

2. Connect to each node and use the setParameter command [1] to:连接到每个节点并使用setParameter命令[1]：

   1. Update the tlsMode to preferSSL. With the tlsMode set to preferTLS, the node accepts both TLS/SSL and non-TLS/non-SSL incoming connections, and its outgoing connections use TLS/SSL.将tlsMode更新为preferSSL。当tlsMode设置为preferTLS时，节点接受TLS/SSL和非TLS/非SSL传入连接，其传出连接使用TLS/SSL。
   2. Update the clusterAuthMode to sendX509. 将clusterAuthMode更新为sendX509。With the clusterAuthMode set to sendX509, each node sends its net.tls.clusterFile to authenticate itself as a member. 当clusterAuthMode设置为sendX509时，每个节点都会发送其net.tls.clusterFile来验证其成员身份。However, each node continues to accept either a keyfile or an X.509 certificate from other members to authenticate those members.但是，每个节点继续接受来自其他成员的键文件或X.509证书，以对这些成员进行身份验证。

   db.adminCommand( { setParameter: 1, tlsMode: "preferTLS" } );
   db.adminCommand( { setParameter: 1, clusterAuthMode: "sendX509" } );

   Upgrade all nodes of the cluster to these settings before continuing.在继续之前，请将群集的所有节点升级到这些设置。

3. After the upgrade of all nodes, edit the configuration file with the appropriate TLS/SSL and X.509 settings to ensure that upon subsequent restarts, the cluster uses X.509 authentication.升级所有节点后，使用适当的TLS/SSL和X.509设置编辑配置文件，以确保在后续重新启动时，集群使用X.509身份验证。

   net:
      tls:
         mode: preferTLS
         certificateKeyFile: /etc/ssl/mongodb.pem
         clusterFile: "/etc/ssl/myReplMembershipCertificateKeyFile.pem"
         CAFile: /etc/ssl/caToValidateReceivedCertificates.pem
   security:
      clusterAuthMode: sendX509
   replication:
      replSetName: myReplicaSet
   net:
      bindIp: localhost,mongodb0.example.net
      port: 27017
   systemLog:
      destination: file
      path: "/var/log/mongodb/mongod.log"
      logAppend: true
   storage:
      dbPath: "/var/lib/mongodb"
   processManagement:
      fork: true

   Note

   At this point,此时，

   • The nodes in the cluster use TLS/SSL connections. However, the nodes can accept non-TLS/SSL connections from client applications.集群中的节点使用TLS/SSL连接。但是，节点可以接受来自客户端应用程序的非TLS/SSL连接。
   • The nodes send their X.509 certificates for membership authentication, but can accept either X.509 certificates or keyfiles from other nodes to verify the other nodes' membership.节点发送其X.509证书进行成员身份验证，但可以接受来自其他节点的X.509证书或键文件来验证其他节点的成员身份。

   To enforce TLS/SSL connections from client applications as well as only accept X.509 for membership authentication, see next step.要从客户端应用程序强制执行TLS/SSL连接，并仅接受X.509进行成员身份验证，请参阅下一步。

4. Optional but recommended. Update all nodes to use only TLS/SSL connections and only X.509 certificate for membership authentication.可选，但推荐。更新所有节点，使其仅使用TLS/SSL连接和X.509证书进行成员身份验证。

   Important

   This TLS/SSL connection requirement applies to all connections; that is, with the clients as well as with the members of the cluster. That is, clients must specify TLS/SSL connections and presents its certificate key file when connecting to the cluster. 此TLS/SSL连接要求适用于所有连接；也就是说，与客户端以及集群的成员。也就是说，客户端必须指定TLS/SSL连接，并在连接到集群时显示其证书键文件。See Connect to MongoDB Instances that Require Client Certificates for more information on connecting with TLS/SSL. 有关使用TLS/SSL连接的更多信息，请参阅连接到需要客户端证书的MongoDB实例。See also Validate Only if a Client Presents a Certificate.另请参见仅在客户端提供证书时验证。

   Update the net.tls.mode to requireTLS and security.clusterAuthMode to x509.将net.tls.mode更新为requireTLS，将security.clusterAuthMode更新为x509。

   For example:例如：

   net:
      tls:
         mode: requireTLS
         certificateKeyFile: /etc/ssl/mongodb.pem
         clusterFile: "/etc/ssl/myReplMembershipCertificateKeyFile.pem"
         CAFile: /etc/ssl/caToValidateReceivedCertificates.pem
   security:
      clusterAuthMode: x509
   replication:
      replSetName: myReplicaSet
   net:
      bindIp: localhost,mongodb0.example.net
      port: 27017
   systemLog:
      destination: file
      path: "/var/log/mongodb/mongod.log"
      logAppend: true
   storage:
      dbPath: "/var/lib/mongodb"
   processManagement:
      fork: true

Clusters Currently Using TLS/SSL (Using ssl Options)当前使用TLS/SSL的集群（使用ssl选项）

For clusters using TLS/SSL and keyfile authentication, to upgrade to X.509 cluster authentication, use the following rolling upgrade process:对于使用TLS/SSL和键文件身份验证的集群，要升级到X.509集群身份验证，请使用以下滚动升级过程：

1. For each node of a cluster, start the node with the option --clusterAuthMode set to sendKeyFile and the option --sslClusterFile set to the appropriate path of the node's certificate. 对于集群的每个节点，将选项--clusterAuthMode设置为sendKeyFile并将选项--sslClusterFile设置为节点证书的适当路径来启动节点。Include other TLS/SSL options as well as any other options that are required for your specific configuration. For example:包括其他TLS/SSL选项以及特定配置所需的任何其他选项。例如：

   mongod --replSet <name> --sslMode requireSSL --clusterAuthMode sendKeyFile --sslClusterFile <path to membership certificate and key PEM file> --sslPEMKeyFile <path to TLS/SSL Certificate and key PEM file>  --sslCAFile <path to root CA PEM file> --bind_ip localhost,<hostname(s)|ip address(es)>

   With this setting, each node continues to use its keyfile to authenticate itself as a member. However, each node can now accept either a keyfile or an X.509 certificate from other members to authenticate those members. Upgrade all nodes of the cluster to this setting.通过此设置，每个节点继续使用其键文件来验证其成员身份。但是，每个节点现在都可以接受来自其他成员的键文件或X.509证书，以对这些成员进行身份验证。将群集的所有节点升级到此设置。

2. Then, for each node of a cluster, connect to the node and use the setParameter command to update the clusterAuthMode to sendX509. 然后，对于集群的每个节点，连接到该节点并使用setParameter命令将clusterAuthMode更新为sendX509。[1] For example,例如，

   db.adminCommand( { setParameter: 1, clusterAuthMode: "sendX509" } )

   With this setting, each node uses its X.509 certificate, specified with the --sslClusterFile option in the previous step, to authenticate itself as a member. However, each node continues to accept either a keyfile or an X.509 certificate from other members to authenticate those members. Upgrade all nodes of the cluster to this setting.使用此设置，每个节点使用其X.509证书（在上一步中使用--sslClusterFile选项指定）来验证其作为成员的身份。但是，每个节点继续接受来自其他成员的键文件或X.509证书，以对这些成员进行身份验证。将群集的所有节点升级到此设置。

3. Optional but recommended. 可选，但推荐。Finally, for each node of the cluster, connect to the node and use the setParameter command to update the clusterAuthMode to x509 to only use the X.509 certificate for authentication. 最后，对于集群的每个节点，连接到该节点并使用setParameter命令将clusterAuthMode更新为x509，以便仅使用X.509证书进行身份验证。[1] For example:例如：

   db.adminCommand( { setParameter: 1, clusterAuthMode: "x509" } )

4. After the upgrade of all nodes, edit the configuration file with the appropriate X.509 settings to ensure that upon subsequent restarts, the cluster uses X.509 authentication.升级所有节点后，使用适当的X.509设置编辑配置文件，以确保在后续重新启动时，集群使用X.509身份验证。

See --clusterAuthMode for the various modes and their descriptions.有关各种模式及其说明，请参阅--clusterAuthMode。

Clusters Currently Not Using TLS/SSL (Using ssl Options)当前未使用TLS/SSL的群集（使用ssl选项）

For clusters using keyfile authentication but not TLS/SSL, to upgrade to X.509 authentication, use the following rolling upgrade process:对于使用键文件身份验证但不使用TLS/SSL的集群，要升级到X.509身份验证，请使用以下滚动升级过程：

1. For each node of a cluster, start the node with the option --sslMode set to allowSSL, the option --clusterAuthMode set to sendKeyFile and the option --sslClusterFile set to the appropriate path of the node's certificate. 对于集群的每个节点，使用选项--sslMode设置为allowSSL，选项--clusterAuthMode设置为sendKeyFile，选项--sslClusterFile设置为节点证书的适当路径来启动节点。Include other TLS/SSL options as well as any other options that are required for your specific configuration. For example:包括其他TLS/SSL选项以及特定配置所需的任何其他选项。例如：

   mongod --replSet <name> --sslMode allowSSL --clusterAuthMode sendKeyFile --sslClusterFile <path to membership certificate and key PEM file> --sslPEMKeyFile <path to TLS/SSL certificate and key PEM file> --sslCAFile <path to root CA PEM file> --bind_ip localhost,<hostname(s)|ip address(es)>

   The --sslMode allowSSL setting allows the node to accept both TLS/SSL and non-TLS/non-SSL incoming connections. The node's outgoing connections do not use TLS/SSL.--sslMode allowSSL设置允许节点接受TLS/SSL和非TLS/非SSL传入连接。节点的传出连接不使用TLS/SSL。

   The --clusterAuthMode sendKeyFile setting allows each node continues to use its keyfile to authenticate itself as a member. However, each node can now accept either a keyfile or an X.509 certificate from other members to authenticate those members.--clusterAuthMode sendKeyFile设置允许每个节点继续使用其键文件来验证其成员身份。但是，每个节点现在都可以接受来自其他成员的键文件或X.509证书，以对这些成员进行身份验证。

   Upgrade all nodes of the cluster to these settings.将群集的所有节点升级到这些设置。

2. Then, for each node of a cluster, connect to the node and use the setParameter command to update the sslMode to preferSSL and the clusterAuthMode to sendX509. 然后，对于集群的每个节点，连接到该节点并使用setParameter命令将sslMode更新为preferSSL，将clusterAuthMode更新为sendX509。[1] For example:例如：

   db.adminCommand( { setParameter: 1, sslMode: "preferSSL", clusterAuthMode: "sendX509" } )

   With the sslMode set to preferSSL, the node accepts both TLS/SSL and non-TLS/non-SSL incoming connections, and its outgoing connections use TLS/SSL.当sslMode设置为preferSSL时，节点接受TLS/SSL和非TLS/非SSL传入连接，其传出连接使用TLS/SSL。

   With the clusterAuthMode set to sendX509, each node uses its X.509 certificate, specified with the --sslClusterFile option in the previous step, to authenticate itself as a member. 当clusterAuthMode设置为sendX509时，每个节点都使用其X.509证书（在上一步中用--sslClusterFile选项指定）来验证其作为成员的身份。However, each node continues to accept either a keyfile or an X.509 certificate from other members to authenticate those members.但是，每个节点继续接受来自其他成员的键文件或X.509证书，以对这些成员进行身份验证。

   Upgrade all nodes of the cluster to these settings.将群集的所有节点升级到这些设置。

3. Optional but recommended. 可选，但推荐。Finally, for each node of the cluster, connect to the node and use the setParameter command to update the sslMode to requireSSL and the clusterAuthMode to x509. 最后，对于集群的每个节点，连接到该节点并使用setParameter命令将sslMode更新为requireSSL，将clusterAuthMode更新为x509。[1] For example:

   db.adminCommand( { setParameter: 1, sslMode: "requireSSL", clusterAuthMode: "x509" } )

   With the sslMode set to requireSSL, the node only uses TLS/SSLs connections.当sslMode设置为requireSSL时，节点仅使用TLS/SSL连接。

   With the clusterAuthMode set to x509, the node only uses the X.509 certificate for authentication.当clusterAuthMode设置为x509时，节点仅使用X.509证书进行身份验证。

4. After the upgrade of all nodes, edit the configuration file with the appropriate TLS/SSL and X.509 settings to ensure that upon subsequent restarts, the cluster uses X.509 authentication.升级所有节点后，使用适当的TLS/SSL和X.509设置编辑配置文件，以确保在后续重新启动时，集群使用X.509身份验证。

See --clusterAuthMode for the various modes and their descriptions.有关各种模式及其说明，请参阅--clusterAuthMode。