Configure SSL For MongoDB

[vincenttabora (VTCE)]

This is for configuring SSL security on an Ubuntu/Linux server running MongoDB.

We will then apply that digital certificate to a MongoDB server.

• Total time: 5-10 minutes
• Tools used: certbot

Step 1: Pre-requisites and Requirements

• Ubuntu 18.x release and higher
• MongoDB v 4.2.x and Higher
• certbot

We will obtain a digital certificate using certbot from Let’s Encrypt.

Step 2: Generate The Digital Certificate

From the console terminal on the Ubuntu server:

$ sudo cat /etc/letsencrypt/archive/test.example.com/{fullchain1.pem,privkey1.pem} | sudo tee /etc/ssl/mongo.pem

This generates the SSL certificate file “mongo.pem”.

Substitute “test.example.com” with the name of your FQDN (production server) or registered A record on your network.

You can also give a different name to the PEM file, based on your naming convention.

Step 3: Change Ownership Of Certificate

Issue the command:

$ sudo chown mongodb:mongodb /etc/ssl/mongo.pem

This assumes that you have a running instance mongod process with the user mongodb

Step 4: Set The Permissions

Set the permissions for the certificate:

$ sudo chmod 600 /etc/ssl/mongo.pem

This sets permission for read, write and execute for the owner.

Step 5: Edit Configuration File

Open the mongod.conf file and add the following information:

ssl:

mode: requireSSL
PEMKeyFile: /etc/ssl/mongo.pem

This will point mongod to the SSL certificate.

Note: Make sure you have indented spaces for mode and PEMKeyFile entry (see attached image)

Step 6: Restart the mongod service

Run the command:

$ sudo service mongod restart