Navigation

	Home Page
	Index
	All Pages

Quick Search

Advanced Search »

Contributor Links

	Create a new Page
	Administration
	File Management
	Login/Logout
	Your Profile

Other Wiki Sections

Software

Page History: Configuring Encryption in Transit - Mongo DB

Compare Page Revisions

« Older Revision - Back to Page History - Newer Revision »

Page Revision: Thu, Jul 14, 2016, 2:25 PM

Overview¶

This article provides the steps to take to configure encryption in transit for Mongo DB.

Assumptions¶

The client machines are assumed to be web servers.
The Mongo DB instances are assumed to be running on Linux server(s).
All servers are running as EC2 server instances under Amazon Web Services.

Procedure¶

Create the Root Certificate Authority Certificate¶

This part of the procedure should be done on a PROTECTED machine i.e., NOT the Mongo DB or web server.

1. Create a folder to hold the Root CA Files

mkdir MyRootCA

2. Generate an RSA key pair

openssl genrsa -out MyRootCA.key 2048

3. Generate the Root CA Certificate

openssl req -x509 -new -key MyRootCA.key -days 365 -out MyRootCA.crt

4. Concatenate the CRT and KEY files into a PEM file

Windows
type MyRootCA.crt MyRootCA.key > MyRootCA.pem

Linux
cat MyRootCA.crt MyRootCA.key > MyRootCA.pem

Generate SSL Certificate for Each Server¶
This part of the procedure should be done on a PROTECTED machine on behalf of each Mongo DB server, as well as each web server.

1. Set HOSTNAME environment variable

Windows
SET HOSTNAME=PublicDnsOfServer SET ROOTCA=MyRootCA

Linux
HOSTNAME='PublicDnsOfServer' ROOTCA='MyRootCA' export HOSTNAME export ROOTCA

Notice

All the commands for the rest of this part of the procedure are the versions for Windows. The equivalent Linux command is found by replacing %HOSTNAME% with $HOSTNAME and %ROOTCA% with $ROOTCA.

2. Create a folder for each server's files as a sibling to the MyRootCA folder created above.

mkdir %HOSTNAME% CD %HOSTNAME%

3. Generate Key Pair for the Server

openssl genrsa -out %HOSTNAME%.key 2048

4. Create CSR (Certificate Signing Request)

openssl req -new -key %HOSTNAME%.key -out %HOSTNAME%.csr

Fill in fields manually
When prompted for the Common Name for the CSR, specify the Public DNS Name of the server. Do NOT use %HOSTNAME%.

5. Fulfill the CSR

openssl x509 -req -in %HOSTNAME%.csr -CA ..\%ROOTCA%\%ROOTCA%.crt -CAkey ..\%ROOTCA%\%ROOTCA%.key -CAcreateserial -out %HOSTNAME%.crt -days 500

6. Validate the certificate against the CA file

openssl verify -CAfile ..\%ROOTCA%\%ROOTCA%.crt %HOSTNAME%.crt

Should get the following.

HOSTNAME.crt: OK

7. Concatenate CRT and KEY files into PEM file

type %HOSTNAME%.crt %HOSTNAME%.key > %HOSTNAME%.pem

On Linux, use the cat command instead of type.

Install Certificate Files on Mongo DB Servers¶
1. Upload files to each Mongo DB server to the /home/ec2-user folder

MyRootCA.crt
MyMongoServer.com.pem

2. Move the files to the proper folder

cd /etc/ssl mv /home/ec2-user/MyRootCA.crt . mv /home/ec2-user/MyMongoServer.com.pem .

3. Adjust security on uploaded files

chown root:root MyRootCA.crt chown root:root MyMongoServer.com.pem

4. Adjust Mongo DB configuration: Edit the /etc/mongod.conf, adding the following lines to the net: section

ssl: mode: requireSSL PEMKeyFile: /etc/ssl/MyMongoServer.com.pem CAFile: /etc/ssl/MyMongoServer.com.crt

5. Validate the above change

cat /etc/mongod.conf | grep ssl

6. Restart the Mongo DB service

service mongod status service mongod stop service mongod status service mongod start service mongod status

7. Verify you can log into Mongo locally

mongo ssl sslCAFile "/etc/ssl/MyRootCA.crt" sslPEMKeyFile "/etc/ssl/MyMongoServer.com.pem" --host MyMongoServer.com -u root admin -p

Jasinski Technical Wiki