Which is SSL certificate store does MongoDB use?
Starting in MongoDB 4.0, you can use system SSL certificate stores for Windows and macOS. To use the system SSL certificate store, specify net.ssl.certificateSelector instead of specifying the certificate key file. For example, consider the following configuration file for a mongod instance:
Which is the TLS settings for MongoDB cluster?
The tls settings/options provide identical functionality as the ssl options since MongoDB has always supported TLS 1.0 and later. For each node of a cluster, start the node with the command-line option –tlsMode or the configuration file option net.tls.mode set to allowTLS .
How to check for certificate revocation in MongoDB?
Starting in version 4.4, to check for certificate revocation, MongoDB enables the use of OCSP (Online Certificate Status Protocol) by default as an alternative to specifying a CRL file or using the system SSL certificate store.
What happens if mongosh does not validate server certificate?
If mongosh runs with the –tlsAllowInvalidCertificates option, mongosh will not attempt to validate the server certificates. This creates a vulnerability to expired mongod and mongos certificates as well as to foreign processes posing as valid mongod or mongos instances.
How to set up a TLS / SSL connection in mongod?
To use TLS/SSL connections, include the following TLS/SSL settings in your mongod / mongos instance’s configuration file: Set to requireTLS. This setting restricts each server to use only TLS/SSL encrypted connections. You can also specify either the value allowTLS or preferTLS to set up the use of mixed TLS/SSL modes on a port.
How to create an intermediate certificate for MongoDB?
Create the certificate signing request for the intermediate certificate. When asked for Distinguished Name values, enter the appropriate values for your test Intermediate Authority certificate. Create the intermediate certificate mongodb-test-ia.crt.