Need clarity on .PEM file that is to be provided when using TLS with Libmongoc

Kevin_Kinzler · 2024-12-19T05:36:18.304Z

Hello,

I’m upgrading my company’s Mongo C driver to 1.29.0 from 1.12.0, specifically so we can use TLS 1.3 in connections. The driver is part of our Windows application which we sell to hundreds of client organizations.

I have no experience with referencing specific Certificates or .PEM files through code, so have some basic questions on how this is supposed to work, and/or what Cert I need to acquire to satisfy the requirements under “Specify a CA File” on this page:

mongodb.com

Configure Transport Layer Security (TLS) - C Driver v1.29

Do I just acquire a TLS Cert from DigiCert or another provider, and embed this into my app distribution so it can be found at runtime? Again this application will run in many different environments owned by different organizations. How can I be sure this will work in every external client’s environment?

Isn’t there a way to simply have Windows locate the relevant Cert in the Cert store? I’ve updated a number of other external libraries that we use for TLS, and no other one has had a similar requirement for a .PEM file - rather they just need to be directed to use the Windows Cert store. Did I miss this option somewhere, or do I need to acquire a special Cert for this as I was referring to above?

Any help with clarifying how this is meant to work would be very much appreciated.

Thanks!

-Kevin

chris · 2024-12-19T15:12:02.194Z

Hi @Kevin_Kinzler

What I think you are looking for is further down the page under Native TLS Support on Windows (Secure Channel) that will be using the Windows Certificate Store(and it trusted roots)

https://www.mongodb.com/docs/languages/c/c-driver/current/connect/tls/#native-tls-support-on-windows–secure-channel-

Specifically for the CA_FIle question it is the CA Chain that signed theMongoDB Server Certificate.

Kevin_Kinzler · 2024-12-20T13:07:53.596Z

Thank you, Chris! I appreciate the clarification. It seems maybe I was mis-reading the tlscertificatekeyfile / MONGOC_URI_TLSCERTIFICATEKEYFILE parameter as a requirement, when it is really just an option?

Am I understanding correctly then, that if I don’t set the parameter above, or “tlsCAFile”, then this will cause the driver to use the Windows Certificate Store?

Thanks again for your help!

-Kevin

chris · 2024-12-20T20:17:04.957Z

If compiled against the native tls then when tlsCAFile is not set the Windows Certificate Store is used. When the option is set ONLY the CA’s in the tlsCAFile will be used.

Kevin_Kinzler · 2024-12-20T22:22:29.762Z

Thanks for the follow-up, it seems I should be all set then and no new certificate required.

Marking as Solution, thanks again!

-Kevin

system · 2024-12-25T22:23:18.306Z

This topic was automatically closed 5 days after the last reply. New replies are no longer allowed.