Generate X.509 Client Certificates

Generate an X.509 client certificate.

For production use, your MongoDB deployment should use valid certificates generated and signed by a CA. You or your organization can generate and maintain an independent CA using Kubernetes-native tools such as cert-manager.

Obtaining and managing certificates is beyond the scope of this documentation.

To learn about the properties that your client certificates must have, see Client Certificate Requirements in the MongoDB Manual.

Configure kubectl to default to your namespace.

If you have not already, run the following command to execute all kubectl commands in the namespace you created.

kubectl config set-context $(kubectl config current-context) --namespace=<metadata.namespace>

Copy and save the following example ConfigMap.

Save the following ConfigMap as x509-mongodb-user.yaml:

1
---
2
apiVersion: mongodb.com/v1
3
kind: MongoDBUser
4
metadata:
5
  name: new-x509-user
6
spec:
7
  username: "CN=my-x509-authenticated-user,OU=organizationalunit,O=organization"
8
  db: "$external"
9
  mongodbResourceRef:
10
    name: '<name of the MongoDB resource>'
11
  roles:
12
    - db: "admin"
13
      name: "readWriteAnyDatabase"

This ConfigMap .yaml file describes a MongoDBUser custom object. You can use these custom objects to create MongoDB users. To learn more, see MongoDB User Resource Specification.

In this example, the ConfigMap describes the user as an X.509 user that the client can use to connect to MongoDB with the corresponding X.509 certificate.

Create the X.509 MongoDB user.

Run the following command to apply the ConfigMap and create the X.509 MongoDB user:

kubectl apply -f x509-mongodb-user.yaml

You should see an output similar to the following:

mongodbuser.mongodb.com/new-x509-user created

Verify your newly created user

Run the following command to check the state of the new-x509-user:

kubectl get mdbu/new-x509-user -o yaml

You should see an output similar to the following:

NAME            CREATED AT
new-x509-user   8m

Find the mount location of the CA.

Run the following command to find where in each pod the Kubernetes Operator mounted the CA secret:

kubectl get statefulset <metadata.name> -o yaml

In the output, find the secret-ca mount:

volumeMounts:
  - mountPath: /opt/scripts
    name: database-scripts
    readOnly: true
  - mountPath: /var/lib/mongodb-automation/secrets/ca
    name: secret-ca
    readOnly: true
  - mountPath: /var/lib/mongodb-automation/secrets/certs
    name: secret-certs
    readOnly: true

In the following step when you connect to your database deployment, append secret-ca to the mountPath, which forms the full path:

/var/lib/mongodb-automation/secrets/ca/secret-ca

Use your X.509 user to connect to the MongoDB deployment

Once you have created your X.509 user, try to connect to the deployment using the MongoDB Shell (mongosh):

mongosh --host {host} --port {port} --tls \
  --tlsCAFile </path/to/secret-ca> \
  --tlsCertificateKeyFile <your-cert>.pem \
  --authenticationMechanism MONGODB-X509  \
  --authenticationDatabase '$external'

mongosh --host {host} --port {port} --ssl \
  --sslCAFile </path/to/secret-ca> \
  --sslPEMKeyFile <your-cert>.pem \
  --authenticationMechanism MONGODB-X509 \
  --authenticationDatabase '$external'