Clarification on "Connect to MongoDB Instances Using Encryption" with Recent MongoDB Versions

Ops and Admin Installation & Upgrades
, ,
1

Hello MongoDB Community,

I have a question regarding the current validity of the configuration outlined in the Connect to MongoDB Instances Using Encryption documentation for the latest versions of MongoDB. When I attempt to set up SSL/TLS encryption following this guide, I receive an error referring to SERVER-72839, which seems to indicate changes in how MongoDB handles SSL/TLS configurations.

As a result, I am compelled to follow an alternative configuration path using Set Up mongod and mongos with Client Certificate Validation. However, this approach presents an additional issue: I don’t intend to use client certificate validation. My goal is to enforce server certificate verification only (i.e., ensuring the client validates the server’s CA).

Issue

When using Set Up mongod and mongos with Client Certificate Validation and providing the certificate and .key file in the mongosh client configuration (despite concerns about client possession of the server’s key for security), I encounter the following error:

"ctx":"conn80","msg":"SSL peer certificate validation failed","attr":{"error":"SSL peer certificate validation failed: unsupported certificate purpose"}}

After examining this, it seems MongoDB may be expecting a TLS Web Client Authentication certificate from the client. In our case, the client certificate has only TLS Web Server Authentication, as it’s intended solely for server validation, not mutual client-server authentication.

Question

  1. Is it possible to configure MongoDB with SSL/TLS where only the server’s certificate is validated by the client (without requiring client certificate authentication)? If so, are there specific configurations to achieve this that avoid using allowConnectionsWithoutCertificates, as it feels less secure?

  2. Should the documentation be updated to reflect any changes in MongoDB’s approach to SSL/TLS configuration for the latest versions, especially concerning SERVER-72839?

Thank you for your assistance and any insights on achieving the most secure and accurate configuration!

Best regards,

2

Hi @Lynx

To disable mutual TLS use the option net.tls.allowConnectionsWithoutCertificates

The section, validate-only-if-a-client-presents-a-certificate, in the documentation you linked covers this scenario. Specifying net.tls.CAFile options is also covered there.

Validate Only if a Client Presents a Certificate

In most cases, it is important to ensure that clients present valid certificates. However, if you have clients that cannot present a client certificate or are transitioning to using a certificate, you may only want to validate certificates from clients that present a certificate.

Note

The procedure uses the net.tls settings. For procedures using the net.ssl settings, see Procedures (Using net.ssl Settings).

To bypass client certificate validation for clients that do not present a certificate, include net.tls.allowConnectionsWithoutCertificates set to true.

Important

When starting a mongod instance with TLS/SSL enabled, you must specify a value for the --tlsCAFile flag, the net.tls.CAFile configuration option, or the tlsUseSystemCA parameter.

--tlsCAFile, tls.CAFile, and tlsUseSystemCA are all mutually exclusive.