https://github.com/smallstep/mongo-tls

Complete setups for MongoDB single-node TLS, cluster TLS, and X.509 user authentication, using the step-ca online Certificate Authority.
https://github.com/smallstep/mongo-tls

Last synced: 3 months ago
JSON representation

Complete setups for MongoDB single-node TLS, cluster TLS, and X.509 user authentication, using the step-ca online Certificate Authority.

• Host: GitHub
• URL: https://github.com/smallstep/mongo-tls
• Owner: smallstep
• License: apache-2.0
• Created: 2021-07-19T20:08:03.000Z (over 3 years ago)
• Default Branch: main
• Last Pushed: 2024-02-26T19:04:15.000Z (8 months ago)
• Last Synced: 2024-04-15T22:55:19.526Z (7 months ago)
• Language: Shell
• Homepage:
• Size: 46.9 KB
• Stars: 12
• Watchers: 8
• Forks: 3
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# Securing MongoDB with TLS

These scripts can be used to set up various example MongoDB server configurations that require TLS and use certificates issued by an internal CA.

These scripts were tested on Ubuntu 23.10 and Debian Bookworm

**[See our blog series, Securing MongoDB with TLS, for a detailed introduction and walkthrough of these scripts](https://www.mongodb.com/developer/article/securing-mongodb-with-tls/)**.

All of these Mongo configurations require an online [`step-ca` Certificate Authority](https://github.com/smallstep/certificates/).

Configure and run `0-step-ca.sh` to set one up.

Next, you can run the following examples on separate machines:

* A simple server with Client <-> Server TLS (`1-mongo-server-with-tls.sh`)

* -OR- A three-member replica set cluster (Primary-Secondary-Secondary toplogy) with both Client <-> Server and Cluster Member TLS (run `2-mongo-pss-cluster.sh` on system init, then manually follow the instructions in `create-replica-set.sh`)

Both examples use Docker Compose for simplicity.

In a production environment, you'd obviously want to run a cluster on several machines.

Finally, you can enable X509 Certificate Authentication (for both service users and human users) by following the instructions in `add-x509-user-authenticaiton.sh`.