0

I have built MongoDB with support for SSL and am wondering how it works with certs signed by a certificate authority?

I have a wild card cert for the domain, so if I have mdb(1|2|3|4).domain.com and they are all set up to point to the correct servers, is that all that I need or do I need to do anything specific? Assume I already have the config file setup with PEMKeyfile and CAFile.

My replica-set config is setup using the domain names.

EDIT:

To clarify, what I am wondering about is this, specifically validation of server identity and what I need to do for it, if anything, other than having a certificate authority signed cert:

MongoDB can use any valid SSL certificate issued by a certificate authority, or a self-signed certificate. If you use a self-signed certificate, although the communications channel will be encrypted, there will be no validation of server identity. Although such a situation will prevent eavesdropping on the connection, it leaves you vulnerable to a man-in-the-middle attack. Using a certificate signed by a trusted certificate authority will permit MongoDB drivers to verify the server’s identity.

Improve this question

1 Answer 1

Reset to default
1

If you have the PEMKeyfile and CAFile set up correctly (per the docs) then the remaining piece of the puzzle is to run with requireSSL sslMode to make sure that you will only accept SSL connections for your databases (there are other modes to allow for mixing encrypted and non-encrypted clients, but that is only really recommended for upgrading from non-SSL).

You can also use CRLs to revoke bad certs, allow weak validation for particular clients, but those are optional.

As the weak validation piece suggests you also have to set up your clients to use SSL and that will vary depending on the driver in use (as will getting it to present a valid cert). Don't forget things like MMS agents will need to be enabled for SSL also (commonly forgotten).

Improve this answer
2
  • Sorry, I wasn't clear in the question. I'm wondering about the validation of server identity. With the self signed cert this isn't done but with certificate authority signed it is. So do I need to have the server set up with it's hostname set to mdb1.domain.com or is this validation done some other way?
    – Nalum
    Jul 14, 2014 at 11:37
  • 1
    The validation is basically done using the OpenSSL libraries, so anything that checks out as valid there should be good, and the hostname should be fine as long as the CA and chain checks out. If in doubt you can use the weak validation temporarily to test (basically won't care about the cert presented) and then retest with strong validation.
    – Adam C
    Jul 14, 2014 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.