0

I am trying to setup/add x.509 authentication to secure our application built with a MongoDB 3.4 database. I don't want to use username/password-based authentication to avoid keeping the password in the configuration files.

I have created a CA and self-signed certificates. My steps are below:

openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
cp rootCA.pem  /etc/ssl/certs/
openssl genrsa -out mongodb.key 2048

openssl req -new -key mongodb.key -out mongodb.csr
openssl x509 -req -in mongodb.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out mongodb.crt -days 500 -sha256
cat mongodb.key mongodb.crt > mongodb.pem
cp mongodb.pem  /etc/ssl/certs/
systemctl restart mongod.service

I also have the following lines in my mongo config:

net:
  port: 27017
  bindIp: 0.0.0.0
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/certs/mongodb.pem
    CAFile: /etc/ssl/certs/rootCA.pem

Using the above steps, I am able to get to the point where I could login into the mongo shell with: mongo --ssl --sslCAFile /etc/ssl/certs/rootCA.pem --sslPEMKeyFile /etc/ssl/certs/mongodb.pem --host <HOSTNAME>.

However, in order to do something, I also need to create a user for the client. I get the name with openssl x509 -in /etc/ssl/certs/mongodb.pem -inform PEM -subject -nameopt RFC2253 then try as:

db.getSiblingDB("$external").runCommand(
  {
    createUser: "emailAddress=email@my-domain.com,CN=192.168.171.147,OU=Services,O=MyCompany,L=Odesa,C=UA=",
    roles: [
      { role: "readWrite", db: "admin" },
      { role: "userAdminAnyDatabase", db: "admin" }
    ]
  }
)

I get "Cannot create an x.509 user with a subjectname that would be recognized as an internal cluster member.". I saw somewhere that certificates OU, O combination having to be unique. Perhaps, that is my problem. I don't even need to support a cluster, just a way to secure the MongoDB connection without having to keep a password in plaintext.

Please advise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.