Graylog2 / Graylog2/graylog2-server
add certificate authentication to mongod
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Context
You should be able to secure your Mongo Cluster with [SSL certificates and certificate validation](https://docs.mongodb.com/manual/tutorial/configure-ssl/#set-up-mongod-and-mongos-with-certificate-validation). If you run a Cluster with certificate validation, activated with the following configuration:
```
net:
ssl:
mode: requireSSL
PEMKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/ca.pem
```
The Cluster/Server expect that **every** client provide a client certificate. With the given configuration options in Graylog ( http://api.mongodb.com/java/current/com/mongodb/MongoClientURI.html ) providing this configuration is not possible.
Graylog is only able to connect to a Mongo Cluster/Server that has [SSL enabled](https://docs.mongodb.com/manual/tutorial/configure-ssl/#set-up-mongod-and-mongos-with-ssl-certificate-and-key) with the given string.
```
mongodb_uri = mongodb://localhost/graylog?ssl=true
```
This works *only* if you have added your (internal) CA to the java keystore that is used by Graylog.
## feature request
Add the configuration (and client) option to include certificates for authentication
## Additional information
- https://stackoverflow.com/questions/26837113/configuring-java-mongoclient-to-use-x-509-certificate-for-the-authentication
- [Add CA.der to the keystore](https://connect2id.com/blog/importing-ca-root-cert-into-jvm-trust-store)
## Your Environment
* Graylog Version: 2.4
* Mongo Version: 3.6
Contributor guide
Assessment
This issue has not been assessed yet.