{"id":14956735,"url":"https://github.com/abrindeyev/mongodb-simple-ca","last_synced_at":"2025-10-24T10:30:54.244Z","repository":{"id":150617135,"uuid":"110601960","full_name":"abrindeyev/mongodb-simple-ca","owner":"abrindeyev","description":"The simple Certificate Authority which suits the needs of MongoDB Server.","archived":false,"fork":false,"pushed_at":"2019-06-24T19:27:44.000Z","size":22,"stargazers_count":12,"open_issues_count":1,"forks_count":6,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-01-29T09:44:56.357Z","etag":null,"topics":["certificate-authority","certificates","mongodb","mongodb-database","openssl","ssl-certificates"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/abrindeyev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-11-13T21:04:23.000Z","updated_at":"2024-05-02T23:12:36.000Z","dependencies_parsed_at":"2023-05-26T14:00:18.239Z","dependency_job_id":null,"html_url":"https://github.com/abrindeyev/mongodb-simple-ca","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abrindeyev%2Fmongodb-simple-ca","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abrindeyev%2Fmongodb-simple-ca/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abrindeyev%2Fmongodb-simple-ca/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abrindeyev%2Fmongodb-simple-ca/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/abrindeyev","download_url":"https://codeload.github.com/abrindeyev/mongodb-simple-ca/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":237950811,"owners_count":19392666,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificate-authority","certificates","mongodb","mongodb-database","openssl","ssl-certificates"],"created_at":"2024-09-24T13:13:25.143Z","updated_at":"2025-10-24T10:30:53.671Z","avatar_url":"https://github.com/abrindeyev.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Simple Certificate Authority for MongoDB Server\n\n## DISCLAIMER\n\nThis software is specifically designed to work with MongoDB Server to quickly create a **test** SSL environment. Official MongoDB Support is **not** provided for this, **use at your own RISK**.\n\n## Introduction\n\nThis shell-script creates and maintains the simple private Certificate Authority which you can use to issue the SSL client and server certificates for `mongod`.\n\nRequirements: Bash 3.x or later, OpenSSL, `sed`, `mktemp`, `tar`, `/dev/urandom`.\n\nTested on: macOS High Sierra + LibreSSL, Red Hat Enterprise Linux 7.\n\n## Quick start guide\n\n### 1. Initial configuration\n\n#### 1.1. Run the script to generate the `MongoDB-demo-CA` directory and the default configuration file `.ca_settings.sh`:\n```\n$ ls\nca_mongodb.sh\n\n$ ./ca_mongodb.sh\n[INFO] Generating initial settings file /home/abr/tmp/MongoDB-demo-CA/.ca_settings.sh\n[INFO] Please modify the default values for the COUNTRY, STATE, LOCALITY, CLUSTER_ORG_UNIT and CLIENT_ORG_UNIT in the /home/abr/tmp/MongoDB-demo-CA/.ca_settings.sh file.\n[INFO] Make sure that CLUSTER_ORG_UNIT and CLIENT_ORG_UNIT have different values if you're going to generate and use client certificates!\n[INFO] Once you finish editing the /home/abr/tmp/MongoDB-demo-CA/.ca_settings.sh file, perform the initialization by running this script with the following parameter: initial_ca_init. For example:\n[INFO] ./ca_mongodb.sh initial_ca_init\n```\n\n#### 1.2. Edit the configuration file\n\n```\n$ nano ./MongoDB-demo-CA/.ca_settings.sh\n```\n\nFeel free to change the following variables:\n\n- `COUNTRY`: Country abbreviation;\n- `STATE`: State abbreviation;\n- `LOCALITY`: City;\n- `ORG`: Organization name;\n- `CLUSTER_ORG_UNIT`: Organizational unit name for `mongod` hosts;\n- `CLIENT_ORG_UNIT`: Organizational unit name for `mongod` client certificates.\n\n#### 1.3. Generate the Certificate Authority certificate\n\n```\n$ ./ca_mongodb.sh initial_ca_init\n[INFO] CA path is: /home/abr/tmp/MongoDB-demo-CA\n[INFO] Creating private key for root CA...\nGenerating RSA private key, 4096 bit long modulus\n................................................................................................................................................................................................++\n...........................................................................................................................................................................................................++\ne is 65537 (0x10001)\n[INFO] Creating self-signed root CA certificate\n[INFO] Root CA certificate created:\nsubject= /C=US/ST=NY/L=New York/O=ACME/CN=ACME ROOT CA\n[INFO] Root CA file (PEM format - use this for UNIX/Linux): /home/abr/tmp/MongoDB-demo-CA/root/certs/root.ca.crt.pem\n[INFO] Root CA file (DER format - use this for MS Windows): /home/abr/tmp/MongoDB-demo-CA/root/certs/root.ca.crt.der\n[INFO] Use it for the net.ssl.CAFile configuration option in a mongod.conf (PEM format).\n[INFO] How to import this into MS Windows Trusted Root Certification Authorities store:\n[INFO] https://technet.microsoft.com/en-us/library/cc754841(v=ws.11).aspx\n[INFO] Generating CRL\nUsing configuration from /home/abr/tmp/MongoDB-demo-CA/openssl.cnf\n[INFO] Successfully generated CRL file: /home/abr/tmp/MongoDB-demo-CA/root/crl/ca.crl.pem which will expire in 3650 days. If you're using CRLs in your MongoDB deployment (net.ssl.CRLFile configuration option is defined in mongod.conf), new CRL file needs to be transferred to all hosts in the MongoDB deployment. Those mongod and mongos instances need to be restarted in a rolling manner to make this change effective. When the CRL file expires, MongoDB will stop accepting all new SSL connections until a new CRL file is generated and MongoDB services are restarted.\n[INFO] Oki dockie!\n```\n\n### 2. Generate the server certificate\n\n```\n$ ./ca_mongodb.sh create_and_sign_cert CLUSTER rhel73 rhel-73.acme.qa 10.211.55.20\n\n(OpenSSL output skipped)\n\n[INFO] Server certificate created: /home/abr/tmp/MongoDB-demo-CA/root/private/rhel73.pem\n[INFO] Use it for the net.ssl.PEMKeyFile MongoDB Server configuration option\n[INFO] Oki dockie!\n```\n\nParameters:\n\n- `create_and_sign_cert`: Certificate request creation \u0026 signing mode.\n-  `CLUSTER`: A constant, indicating that the **server** certificate will be created.\n-  `rhel73`: The name for this particular certificate inside Certificate Authority. Certificate's filenames will be derived from this parameter.\n-  `rhel-73.acme.qa 10.211.55.20`: The space-separated list of hostnames and IP addresses for the certificate. The first value in the list goes to the *Common Name* field in the certificate, and the whole list will be represented in the *X509v3 Subject Alternative Name* field.\n\n### 3. Run `mongod` with SSL, no authentication\n\n#### 3.1 Create the following MongoDB Server configuration file (`mongod.conf`):\n\n```\nsystemLog:\n  destination: file\n  logAppend: false\n  path: /home/abr/tmp/mongod.log\nstorage:\n  dbPath: /home/abr/tmp/data\n  journal:\n    enabled: true\nprocessManagement:\n  fork: true\n  pidFilePath: /home/abr/tmp/mongod.pid\nnet:\n  port: 28000\n  bindIp: 0.0.0.0\n  ssl:\n    mode: requireSSL\n    PEMKeyFile: /home/abr/tmp/MongoDB-demo-CA/root/private/rhel73.pem\n    CAFile: /home/abr/tmp/MongoDB-demo-CA/root/certs/root.ca.crt.pem\n```\n\n#### 3.2. Run `mongod` process:\n\n```\n$ mkdir -p /home/abr/tmp/data\n$ mongod -f /home/abr/tmp/mongod.conf\n```\n\n### 4. Generate the client certificate for MongoDB Shell\n\n```\n$ ./ca_mongodb.sh create_and_sign_cert CLIENT shell 'MongoDB Shell'\n\n(OpenSSL output skipped)\n\n[INFO] Client certificate created: /home/abr/tmp/MongoDB-demo-CA/root/private/shell.pem\n[INFO] Here's an example how to add to MongoDB Server by using MongoDB Shell:\n[INFO] \u003e db.getSiblingDB('$external').createUser({ user: 'CN=MongoDB Shell,OU=Development MongoDB Clients,O=ACME,ST=NY,C=US', roles: [ { role: 'root', db: 'admin' } ] });\n[INFO] Oki dockie!\n```\n\nParameters:\n\n- `create_and_sign_cert`: Certificate request creation \u0026 signing mode.\n- `CLIENT`: A constant, indicating that the **client** certificate will be created.\n- `shell`: The name for this particular certificate inside Certificate Authority. Certificate's filenames will be derived from this parameter.\n- `'MongoDB Shell'`: Client certificate's *Common Name*\n\n### 5. Connect to MongoDB Server using the generated client certificate\n\n```\n$ mongo --ssl --host 10.211.55.20 --port 28000 --sslCAFile /home/abr/tmp/MongoDB-demo-CA/root/certs/root.ca.crt.pem --sslPEMKeyFile /home/abr/tmp/MongoDB-demo-CA/root/private/shell.pem\nMongoDB shell version v3.6.3\nconnecting to: mongodb://10.211.55.20:28000/\nMongoDB server version: 3.6.3\nMongoDB Enterprise \u003e\n```\n\n### 6. Create the user for X.509 authentication\n\n```\nMongoDB Enterprise \u003e db.getSiblingDB('$external').createUser({ user: 'CN=MongoDB Shell,OU=Development MongoDB Clients,O=ACME,ST=NY,C=US', roles: [ { role: 'root', db: 'admin' } ] });\nSuccessfully added user: {\n\t\"user\" : \"CN=MongoDB Shell,OU=Development MongoDB Clients,O=ACME,ST=NY,C=US\",\n\t\"roles\" : [\n\t\t{\n\t\t\t\"role\" : \"root\",\n\t\t\t\"db\" : \"admin\"\n\t\t}\n\t]\n}\n```\n\n### 7. Reconfigure MongoDB Server to support X.509 authentication\n\n#### 7.1. Append the following content to the end of the `mongod.conf` file\n\n```\nsecurity:\n  authorization: enabled\nsetParameter:\n  authenticationMechanisms: \"MONGODB-X509\"\n```\n\n#### 7.2. Restart `mongod` process\n\n```\n$ killall mongod\n$ mongod -f ./mongod.conf\n```\n\n### 8. Authenticate using X.509 authentication mechanism\n\n```\n$ mongo --ssl --host 10.211.55.20 --port 28000 --sslCAFile /home/abr/tmp/MongoDB-demo-CA/root/certs/root.ca.crt.pem --sslPEMKeyFile /home/abr/tmp/MongoDB-demo-CA/root/private/shell.pem -u 'CN=MongoDB Shell,OU=Development MongoDB Clients,O=ACME,ST=NY,C=US' --authenticationMechanism MONGODB-X509 --authenticationDatabase '$external'\nMongoDB shell version v3.6.3\nconnecting to: mongodb://10.211.55.20:28000/\nMongoDB server version: 3.6.3\nMongoDB Enterprise \u003e\n```\n\n## Miscellaneous\n\n```\n$ ./ca_mongodb.sh\n[INFO] CA path is: /home/abr/tmp/MongoDB-demo-CA\n[INFO] Simple MongoDB Certification Authority demo app welcomes you!\nUsage: ./ca_mongodb.sh function parameter(s)\nFunctions:\n  initial_ca_init\n  backup_ca\n  restore_ca backup.tar.bz2\n  create_and_sign_cert CLUSTER rs0 rs0.host.name rs0.alternate.name 127.0.0.1 192.168.0.1\n  create_and_sign_cert CLIENT devclient 'Development Client Common Name'\n  revoke_certificate rs0\n  generate_crl\n[INFO] Oki dockie!\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fabrindeyev%2Fmongodb-simple-ca","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fabrindeyev%2Fmongodb-simple-ca","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fabrindeyev%2Fmongodb-simple-ca/lists"}