I have built MongoDB with support for SSL and am wondering how it works with certs signed by a certificate authority?
I have a wild card cert for the domain, so if I have mdb(1|2|3|4).domain.com
and they are all set up to point to the correct servers, is that all that I need or do I need to do anything specific? Assume I already have the config file setup with PEMKeyfile
and CAFile
.
My replica-set config is setup using the domain names.
EDIT:
To clarify, what I am wondering about is this, specifically validation of server identity
and what I need to do for it, if anything, other than having a certificate authority signed cert:
MongoDB can use any valid SSL certificate issued by a certificate authority, or a self-signed certificate. If you use a self-signed certificate, although the communications channel will be encrypted, there will be no validation of server identity. Although such a situation will prevent eavesdropping on the connection, it leaves you vulnerable to a man-in-the-middle attack. Using a certificate signed by a trusted certificate authority will permit MongoDB drivers to verify the server’s identity.