Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-97619

Create a CA pair unique to the mongod-mongot connection

    • Type: Icon: Task Task
    • Resolution: Unresolved
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • Server Security
    • Security 2024-12-09, Security 2024-12-23

      NOTE: There needs to be a discussion about whether or not we want to do this, this ticket is currently being filed to ensure that discussion happens.

      The context is:

      As part of INIT-539, we needed to enable TLS connections between mongot and mongod. We considered 2 options:

      • OPTION A: We force mongot to use the same CA as driver/server communication uses, and do not introduce new server parameters for mongot certificates.
      • OPTION B: We create new tlsMongotCAFile and tlsMongotClusterCertificateFile server parameters to allow the customer to configure a different CA for mongod/mongot communication.

      It made the most sense to proceed with Option A for the time being, as it was simpler and Option B seemed like it would require much more extensive discussions about CA management in general. But, having more configurability options, as Option B would provide, may be desirable.

            Assignee:
            sara.golemon@mongodb.com Sara Golemon
            Reporter:
            reilly.mcbride@mongodb.com Reilly McBride
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: