-
Type: Task
-
Resolution: Unresolved
-
Priority: Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
-
None
-
Server Security
-
Security 2024-12-09, Security 2024-12-23
NOTE: There needs to be a discussion about whether or not we want to do this, this ticket is currently being filed to ensure that discussion happens.
The context is:
As part of INIT-539, we needed to enable TLS connections between mongot and mongod. We considered 2 options:
- OPTION A: We force mongot to use the same CA as driver/server communication uses, and do not introduce new server parameters for mongot certificates.
- OPTION B: We create new tlsMongotCAFile and tlsMongotClusterCertificateFile server parameters to allow the customer to configure a different CA for mongod/mongot communication.
It made the most sense to proceed with Option A for the time being, as it was simpler and Option B seemed like it would require much more extensive discussions about CA management in general. But, having more configurability options, as Option B would provide, may be desirable.
- is related to
-
SERVER-97371 enable mongod egress TLS connections to mongot via existing CAs
- In Progress