4 ms·
Not sure I get the point of this. Seems way overly complicated. Why not just: cd /etc/ssl ### 10 year expiration openssl req -newkey rsa:2048 -new
by nodesocket 8y ago
Not sure I get the point of this. Seems way overly complicated. Why not just:
cd /etc/ssl
### 10 year expiration
openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -out mongodb-cert.crt -keyout mongodb-cert.key
cat mongodb-cert.key mongodb-cert.crt > mongodb.pem
Then in the MongoDB config:
sslMode = requireSSL
sslPEMKeyFile = /etc/ssl/mongodb.pem
The only gotcha is in your clients you may have to set a flag:
"allow_self_signed" => true
- charleslmunger 8y agoIf you tell your clients to allow self signed certs, your connection is vulnerable to a MITM, which is usually what you're trying to avoid by using TLS...
- pritambaral 8y agoThat's worse than no TLS: it gives a false-sense of security while actually securing nothing. All because of that "allow_self_signed". "Allow self-signed" is literally just "trust anyone, no matter what". The entire point of certificates is to delegate trust. The verifying party (a client, in this case) trusts an authority, and the authority trusts and vouches for the authenticatee. "Allow self-signed" allows absolutely anyone to be the "authority". Instead, you should be telling to verifying party exactly who is the authority, which, in this case, could be the certificate you created.