Securing MongoDB Using Let's Encrypt Certificate

Re:Securing MongoDB Using Let's Encrypt Certificate by nodesocket on Tuesday September 11, 2018 @06:43PM (#17964069)

Not sure I get the point of this. Seems way overly complicated. Why not just:

    cd /etc/ssl
    ### 10 year expiration
    openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -out mongodb-cert.crt -keyout mongodb-cert.key
    cat mongodb-cert.key mongodb-cert.crt > mongodb.pem

Then in the MongoDB config:

   sslMode = requireSSL
   sslPEMKeyFile = /etc/ssl/mongodb.pem

The only gotcha is in your clients you may have to set a flag:

    "allow_self_signed" => true

[ Parent | on HN ]

Re:Securing MongoDB Using Let's Encrypt Certificate by pritambaral on Wednesday September 12, 2018 @12:21AM (#17965527)

That's worse than no TLS: it gives a false-sense of security while actually securing nothing. All because of that "allow_self_signed".

"Allow self-signed" is literally just "trust anyone, no matter what". The entire point of certificates is to delegate trust. The verifying party (a client, in this case) trusts an authority, and the authority trusts and vouches for the authenticatee. "Allow self-signed" allows absolutely anyone to be the "authority". Instead, you should be telling to verifying party exactly who is the authority, which, in this case, could be the certificate you created.

[ Parent | on HN ]

Re:Securing MongoDB Using Let's Encrypt Certificate by charleslmunger on Tuesday September 11, 2018 @08:07PM (#17964546)

If you tell your clients to allow self signed certs, your connection is vulnerable to a MITM, which is usually what you're trying to avoid by using TLS...

[ Parent | on HN ]