Skip to content

Instantly share code, notes, and snippets.

@siddhantprateek

siddhantprateek/generate-mongo-ssl.md

Forked from achesco/generate-mongo-ssl.md
Created May 31, 2024 15:57
Show Gist options
  • Save siddhantprateek/a80b8ee13678bc14e9c93c4eefa14bd9 to your computer and use it in GitHub Desktop.
Save siddhantprateek/a80b8ee13678bc14e9c93c4eefa14bd9 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 5 additions and 5 deletions.
    10 changes: 5 additions & 5 deletions generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -41,11 +41,11 @@ mongo --ssl --sslAllowInvalidHostnames --sslCAFile mongodb-ca.crt --sslPEMKeyFil
    #### NodeJs, mongo connection options
    ```js
    {
    "ssl": true,
    "sslValidate": true,
    "sslKey": fs.readFileSync('/etc/ssl/mongodb.pem'),
    "sslCert": fs.readFileSync('/etc/ssl/mongodb-cert.crt'),
    "sslCa": fs.readFileSync('/etc/ssl/mongodb-ca.crt')
    ssl: true,
    sslValidate: true,
    sslKey: fs.readFileSync('/etc/ssl/mongodb.pem'),
    sslCert: fs.readFileSync('/etc/ssl/mongodb-cert.crt'),
    sslCA: fs.readFileSync('/etc/ssl/mongodb-ca.crt')
    }
    ```

  2. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 3 additions and 0 deletions.
    3 changes: 3 additions & 0 deletions generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,6 +7,9 @@ openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -subj '/C=US/ST=Massac
    ```bash
    cat mongodb-cert.key mongodb-cert.crt > mongodb.pem
    ```
    ```bash
    cp mongodb-cert.crt mongodb-ca.crt
    ```

    #### Edit _/etc/mongod.conf_, _network interfaces_ section
    ```apache
  3. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -38,7 +38,8 @@ mongo --ssl --sslAllowInvalidHostnames --sslCAFile mongodb-ca.crt --sslPEMKeyFil
    #### NodeJs, mongo connection options
    ```js
    {
    "sslValidate": false, // true - disable validation
    "ssl": true,
    "sslValidate": true,
    "sslKey": fs.readFileSync('/etc/ssl/mongodb.pem'),
    "sslCert": fs.readFileSync('/etc/ssl/mongodb-cert.crt'),
    "sslCa": fs.readFileSync('/etc/ssl/mongodb-ca.crt')
  4. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -38,7 +38,7 @@ mongo --ssl --sslAllowInvalidHostnames --sslCAFile mongodb-ca.crt --sslPEMKeyFil
    #### NodeJs, mongo connection options
    ```js
    {
    "sslValidate": false, // true - disable validation
    "sslValidate": false, // true - disable validation
    "sslKey": fs.readFileSync('/etc/ssl/mongodb.pem'),
    "sslCert": fs.readFileSync('/etc/ssl/mongodb-cert.crt'),
    "sslCa": fs.readFileSync('/etc/ssl/mongodb-ca.crt')
  5. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 9 additions and 8 deletions.
    17 changes: 9 additions & 8 deletions generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -2,10 +2,10 @@ CNs are important!!! -days 3650

    #### Make PEM containig a public key certificate and its associated private key
    ```bash
    openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -subj '/C=US/ST=Massachusetts/L=Bedford/O=Personal/OU=Personal/[email protected]/CN=localhost' -out mongo.crt -keyout mongo.key
    openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -subj '/C=US/ST=Massachusetts/L=Bedford/O=Personal/OU=Personal/[email protected]/CN=localhost' -out mongodb-cert.crt -keyout mongodb-cert.key
    ```
    ```bash
    cat mongo.key mongo.crt > mongo.pem
    cat mongodb-cert.key mongodb-cert.crt > mongodb.pem
    ```

    #### Edit _/etc/mongod.conf_, _network interfaces_ section
    @@ -16,8 +16,8 @@ net:
    bindIp: 127.0.0.1
    ssl:
    mode: allowSSL
    PEMKeyFile: /etc/ssl/mongo.pem
    #CAFile: /etc/ssl/mongo.crt
    PEMKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/mongodb-cert.crt
    ```

    #### Check for startup config errors
    @@ -32,15 +32,16 @@ sudo service mongod restart

    #### Test-connect
    ```bash
    mongo --ssl --sslAllowInvalidHostnames --sslAllowInvalidCertificates
    mongo --ssl --sslAllowInvalidHostnames --sslCAFile mongodb-ca.crt --sslPEMKeyFile /etc/ssl/mongodb.pem
    ```

    #### NodeJs, mongo connection options
    ```js
    {
    "sslValidate": false,
    "sslKey": fs.readFileSync('/etc/ssl/mongodb.pem'),
    "sslCert": fs.readFileSync('/etc/ssl/mongodb-cert.crt')
    "sslValidate": false, // true - disable validation
    "sslKey": fs.readFileSync('/etc/ssl/mongodb.pem'),
    "sslCert": fs.readFileSync('/etc/ssl/mongodb-cert.crt'),
    "sslCa": fs.readFileSync('/etc/ssl/mongodb-ca.crt')
    }
    ```

  6. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    CNs are important!!! -days 3650

    #### Make PEM containig a public key certificate and its associated private key
    ```bash
    openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -subj '/C=US/ST=Massachusetts/L=Bedford/O=Personal/OU=Personal/[email protected]/CN=localhost' -out mongo.crt -keyout mongo.key
  7. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,6 @@
    #### Make PEM containig a public key certificate and its associated private key
    ```bash
    openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -out mongo.crt -keyout mongo.key
    openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -subj '/C=US/ST=Massachusetts/L=Bedford/O=Personal/OU=Personal/[email protected]/CN=localhost' -out mongo.crt -keyout mongo.key
    ```
    ```bash
    cat mongo.key mongo.crt > mongo.pem
  8. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,8 @@
    #### Make PEM containig a public key certificate and its associated private key
    ```bash
    openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -out mongo.crt -keyout mongo.key
    ```
    ```bash
    cat mongo.key mongo.crt > mongo.pem
    ```

  9. @achesco achesco revised this gist Mar 27, 2018. 1 changed file with 30 additions and 3 deletions.
    33 changes: 30 additions & 3 deletions generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -9,10 +9,37 @@ cat mongo.key mongo.crt > mongo.pem
    # network interfaces
    net:
    port: 27017
    #bindIp: 127.0.0.1
    bindIp: 127.0.0.1
    ssl:
    mode: allowSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    #CAFile: /etc/ssl/mongodb-cert.crt
    PEMKeyFile: /etc/ssl/mongo.pem
    #CAFile: /etc/ssl/mongo.crt
    ```

    #### Check for startup config errors
    ```bash
    sudo mongod --config /etc/mongod.conf
    ```

    #### Restart mongo
    ```bash
    sudo service mongod restart
    ```

    #### Test-connect
    ```bash
    mongo --ssl --sslAllowInvalidHostnames --sslAllowInvalidCertificates
    ```

    #### NodeJs, mongo connection options
    ```js
    {
    "sslValidate": false,
    "sslKey": fs.readFileSync('/etc/ssl/mongodb.pem'),
    "sslCert": fs.readFileSync('/etc/ssl/mongodb-cert.crt')
    }
    ```




  10. @achesco achesco created this gist Mar 27, 2018.
    18 changes: 18 additions & 0 deletions generate-mongo-ssl.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    #### Make PEM containig a public key certificate and its associated private key
    ```bash
    openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -out mongo.crt -keyout mongo.key
    cat mongo.key mongo.crt > mongo.pem
    ```

    #### Edit _/etc/mongod.conf_, _network interfaces_ section
    ```apache
    # network interfaces
    net:
    port: 27017
    #bindIp: 127.0.0.1
    ssl:
    mode: allowSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    #CAFile: /etc/ssl/mongodb-cert.crt
    ```