How to Generate a Server Certificate for MongoDB¶
This page enumerates the steps we use to generate a server certificate for a MongoDB instance. A server certificate is also referred to as a “member certificate” in the MongoDB documentation. We use Easy-RSA.
Step 1: Install & Configure Easy–RSA¶
First create a directory for the server certificate (member cert) and cd into it:
mkdir member-cert
cd member-cert
Step 2: Create the Server Private Key and CSR¶
You can create the server private key and certificate signing request (CSR)
by going into the directory member-cert/easy-rsa-3.0.1/easyrsa3
and using something like:
Note
Please make sure you are fullfilling the requirements for MongoDB server/member certificates.
./easyrsa init-pki
./easyrsa --req-cn=mdb-instance-0 --subject-alt-name=DNS:localhost,DNS:mdb-instance-0 gen-req mdb-instance-0 nopass
You should replace the Common Name (mdb-instance-0
above) with the correct name for your MongoDB instance in the network, e.g. mdb-instance-5
or mdb-instance-12
. (This name is decided by the organization managing the network.)
You will be prompted to enter the Distinguished Name (DN) information for this certificate. For each field, you can accept the default value [in brackets] by pressing Enter.
Warning
Don’t accept the default value of OU (IT
). Instead, enter the value MongoDB-Instance
.
Aside: You need to provide the DNS:localhost
SAN during certificate generation
for using the localhost exception
in the MongoDB instance.
All certificates can have this attribute without compromising security as the
localhost exception
works only the first time.
Step 3: Get the Server Certificate Signed¶
The CSR file created in the last step
should be located in pki/reqs/mdb-instance-0.req
(where the integer 0
may be different for you).
You need to send it to the organization managing the BigchainDB network
so that they can use their CA
to sign the request.
(The managing organization should already have a self-signed CA.)
If you are the admin of the managing organization’s self-signed CA,
then you can import the CSR and use Easy-RSA to sign it.
Go to your bdb-node-ca/easy-rsa-3.0.1/easyrsa3/
directory and do something like:
./easyrsa import-req /path/to/mdb-instance-0.req mdb-instance-0
./easyrsa --subject-alt-name=DNS:localhost,DNS:mdb-instance-0 sign-req server mdb-instance-0
Once you have signed it, you can send the signed certificate
and the CA certificate back to the requestor.
The files are pki/issued/mdb-instance-0.crt
and pki/ca.crt
.
Step 4: Generate the Consolidated Server PEM File¶
MongoDB requires a single, consolidated file containing both the public and private keys.
cat /path/to/mdb-instance-0.crt /path/to/mdb-instance-0.key > mdb-instance-0.pem