mirror of
https://github.com/bigchaindb/bigchaindb.git
synced 2024-10-13 13:34:05 +00:00
b6ec3e5f5c
* Support for secure TLS communication in MongoDB, MongoDB Monitoring Agent and MongoDB Backup Agent - Move from Golang to Bash for entrypoint program - Update image tag to 2.0 for Backup and Monitoring Agents and to 3.4.4 for MongoDB - Add documentation * changed title & rewrote Step 1 of workflow.rst * copy-edited ca-installation.rst * copy-edited & modified structure of workflow.rst * moved repeated Easy-RSA install & config docs to new page * edited the sentences describing the Easy-RSA dirs * copy-edited the page about generating server certificate * copy-edited the page about generating client certificate * renamed page to 'How to Set Up a Self-Signed Certificate Authority' * copy-edited page about how to revoke a certificate * Comments on how to uniquely name all instances in the cluster * Added comments about the other questions when setting up a CA * Added note about one Agent Api Key per Cloud Manager backup * docs: clarified instructions for generating server CSR * docs: added back 'from your PKI infrastructure' * docs: fixed step & added step re/ FQDNs & certs in workflow.rst * docs: added note re/ the Distinguished Name * Update docs for env vars setup * docs: added tip: how to get help with the easyrsa command
93 lines
3.0 KiB
ReStructuredText
93 lines
3.0 KiB
ReStructuredText
How to Generate a Server Certificate for MongoDB
|
||
================================================
|
||
|
||
This page enumerates the steps *we* use to generate a
|
||
server certificate for a MongoDB instance.
|
||
A server certificate is also referred to as a "member certificate"
|
||
in the MongoDB documentation.
|
||
We use Easy-RSA.
|
||
|
||
|
||
Step 1: Install & Configure Easy–RSA
|
||
------------------------------------
|
||
|
||
First create a directory for the server certificate (member cert) and cd into it:
|
||
|
||
.. code:: bash
|
||
|
||
mkdir member-cert
|
||
|
||
cd member-cert
|
||
|
||
Then :ref:`install and configure Easy-RSA in that directory <How to Install & Configure Easy-RSA>`.
|
||
|
||
|
||
Step 2: Create the Server Private Key and CSR
|
||
---------------------------------------------
|
||
|
||
You can create the server private key and certificate signing request (CSR)
|
||
by going into the directory ``member-cert/easy-rsa-3.0.1/easyrsa``
|
||
and using something like:
|
||
|
||
.. code:: bash
|
||
|
||
./easyrsa init-pki
|
||
|
||
./easyrsa --req-cn=mdb-instance-0 --subject-alt-name=DNS:localhost,DNS:mdb-instance-0 gen-req mdb-instance-0 nopass
|
||
|
||
You must replace the common name (``mdb-instance-0`` above)
|
||
with the common name of *your* MongoDB instance
|
||
(which should be the same as the hostname of your MongoDB instance).
|
||
|
||
You need to provide the ``DNS:localhost`` SAN during certificate generation for
|
||
using the ``localhost exception`` in the MongoDB instance.
|
||
|
||
All certificates can have this attribute without compromising security as the
|
||
``localhost exception`` works only the first time.
|
||
|
||
Tip: You can get help with the ``easyrsa`` command (and its subcommands)
|
||
by using the subcommand ``./easyrsa help``
|
||
|
||
|
||
Step 3: Get the Server Certificate Signed
|
||
-----------------------------------------
|
||
|
||
The CSR file (created in the last step)
|
||
should be located in ``pki/reqs/mdb-instance-0.req``.
|
||
You need to send it to the organization managing the cluster
|
||
so that they can use their CA
|
||
to sign the request.
|
||
(The managing organization should already have a self-signed CA.)
|
||
|
||
If you are the admin of the managing organization's self-signed CA,
|
||
then you can import the CSR and use Easy-RSA to sign it. For example:
|
||
|
||
.. code:: bash
|
||
|
||
./easyrsa import-req mdb-instance-0.req mdb-instance-0
|
||
|
||
./easyrsa --subject-alt-name=DNS:localhost,DNS:mdb-instance-0 sign-req server mdb-instance-0
|
||
|
||
Once you have signed it, you can send the signed certificate
|
||
and the CA certificate back to the requestor.
|
||
The files are ``pki/issued/mdb-instance-0.crt`` and ``pki/ca.crt``.
|
||
|
||
|
||
Step 4: Generate the Consolidated Server PEM File
|
||
-------------------------------------------------
|
||
|
||
MongoDB requires a single, consolidated file containing both the public and
|
||
private keys.
|
||
|
||
.. code:: bash
|
||
|
||
cat mdb-instance-0.crt mdb-instance-0.key > mdb-instance-0.pem
|
||
|
||
|
||
Step 5: Update the MongoDB Config File
|
||
--------------------------------------
|
||
|
||
In the MongoDB configuration file,
|
||
set the ``net.ssl.PEMKeyFile`` parameter to the path of the ``mdb-instance-0.pem`` file,
|
||
and the ``net.ssl.CAFile`` parameter to the ``ca.crt`` file.
|