Graylog2 / Graylog2/graylog2-server

add certificate authentication to mongod

Open
#4,472 5 comments 3 reactions 0 assignees View on GitHub
documentation
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Context
You should be able to secure your Mongo Cluster with [SSL certificates and certificate validation](https://docs.mongodb.com/manual/tutorial/configure-ssl/#set-up-mongod-and-mongos-with-certificate-validation). If you run a Cluster with certificate validation, activated with the following configuration:

```
net:
ssl:
mode: requireSSL
PEMKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/ca.pem
```

The Cluster/Server expect that **every** client provide a client certificate. With the given configuration options in Graylog ( http://api.mongodb.com/java/current/com/mongodb/MongoClientURI.html ) providing this configuration is not possible.

Graylog is only able to connect to a Mongo Cluster/Server that has [SSL enabled](https://docs.mongodb.com/manual/tutorial/configure-ssl/#set-up-mongod-and-mongos-with-ssl-certificate-and-key) with the given string.

```
mongodb_uri = mongodb://localhost/graylog?ssl=true
```

This works *only* if you have added your (internal) CA to the java keystore that is used by Graylog.

## feature request
Add the configuration (and client) option to include certificates for authentication

## Additional information

- https://stackoverflow.com/questions/26837113/configuring-java-mongoclient-to-use-x-509-certificate-for-the-authentication
- [Add CA.der to the keystore](https://connect2id.com/blog/importing-ca-root-cert-into-jvm-trust-store)

## Your Environment

* Graylog Version: 2.4
* Mongo Version: 3.6

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.