-1

We have a wildcard domain *.apps.acme.net in GoDaddy. This way, when we use our mongo database, we only need to use this:

mongosh --tls --h rs1.apps.acme.net

The mongod.conf is as follow:

net:
  port: 27017
  bindIpAll: true
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/mongodb/ssl/mongodb.pem
    clusterFile: /etc/mongodb/ssl/mongodb.pem

security:
  clusterAuthMode: x509
  authorization: enabled

#replication configuration
replication:
  replSetName: docker-replica-set

Basically, I would like to authenticate the nodes using that certificate but for some reason, it's asking for the CA file even though it's a public certificate authority (GoDaddy).

So, the question is.. why when I try to add internal node authentication, this setup fails? If I remove the security section, everything works fine and the traffic is being encrypted as expected. But when I enabled security.authorization, it started to fail asking for a keyFile because we're running a replica set. I'd like to use a x509 certificate instead of a keyfile since it's the one recommended by Mongo.

I was also looking at the following commands, but never figured out how they worked tbh:

certificateSelector

clusterCertificateSelector

I tried something like this, but nothing:

  tls:
    mode: requireTLS
    certificateSelector: 'subject=CN=Go Daddy Secure Certificate Authority - G2'

Any help or tips would be amazing. Thank you in advance.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.