Starting mongod with TLS now requires specifying a certificate authority:

A security vulnerability was found where a server process running MongoDB 3.2.6 or later will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured (CVE-2024-1351) .

The expected behavior is that this configuration should have validated client certificates against the system CA store.

Atlas clusters are not affected by this vulnerability.

Changes in valid configurations:

This behavior is fixed in version 4.4.29, 5.0.25, 6.0.14 and 7.0.6.

As a result of this fix, MongoDB no longer supports a configuration that enables TLS without explicitly specifying a chain of trust. The server now only allows the following configuration options / server parameter when TLS is configured (.net.tls.mode is 'allowTLS' or greater):

• (Config) .net.tls.CAFile
• (Config) .net.tls.CAFile and .net.tls.clusterCAFile
• (Server Parameter) tlsUseSystemCA

A server in this invalid configuration will fail to start and generate the following error message in the log file:

The use of TLS without specifying a chain of trust is no longer supported. See "https://jira.mongodb.org/browse/SERVER-72839 for details."

Configuring a server to validate client certificates against the system CA now requires the usage of a new server parameter named tlsUseSystemCA.

Next Steps:

To configure a server to use the System CA, start the server with the tlsUseSystemCA server parameter set to true. (See the --setParameter mongod option)

Note that some applications may have been inadvertently using this behavior to allow connections using certificates which are invalid. As such, correctly configuring a server to use the System CA will result in client connections failing.

Troubleshooting

If client connections start failing after setting the tlsUseSystemCA parameter, then clients are presenting invalid certificates that are not valid according to the system CA.

If client connections start failing after setting the tlsUseSystemCA parameter - users may want to:

1. Restart the server with the net.tls.allowInvalidCertificates option in the server configuration file to allow client connections with invalid certificates.
2. Note that the use of net.tls.allowInvalidCertificates is fundamentally unsafe. This option should only be enabled on an interim basis to allow for investigating why certificates are not valid according to the System CA. The net.tls.allowInvalidCertificates should be removed as soon as possible.
3. Review certificates being provided by clients to assess why they are failing System CA validation.