3

I have a multi-node mongo cluster using SSL requireSSL and the certificates are going to expire. Is there a zero-downtime method to update the certs? I know the easiest way would be to stop all nodes, swap out the certs, and restart mongo. Same for all clients. I have not found a way to execute it without a service interruption.

1

If you CA don't change, just cert expiration time, you should not have any problems to change cert one node at the time (rolling upgrade).

But... Basically following this procedure, so you "downgrade" you nodes ssl level allowSSL and doing change of certificate one node at time. After that you can bring ssl level back to requireSSL after everybody have new certs.

1

As long as your new certificates are issued by the same CA, AND the new certificates must match the same "O", "OU" and "DC" DN's fields as the older certificate, see in documentation.

The Organization attributes (O’s), the Organizational Unit attributes (OU’s), and the Domain Components (DC’s) must match those from the certificates for the other cluster members.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.