MongoDB 3.2.x SSL with Letsencrypt

#MongoDB 3.2.x SSL with Letsencrypt Letsencrypt is an initative which aims to increase the use of encryption for websites. It basically allows people to apply for free certificates provided that they prove the they control the requested domain. We will look at the what is needed to secure your MongoDB installation. For more details on setting up a MongoDB server see MongoDB 3.2.x.

##Set the hostname We sould to set the hostname to match the name of the certificate we are going to optain.

sudo hostname mongo0.example.com

Then update the hostname file to set the server name permanently.

sudo nano /etc/hostname

Set the hostname in the file to:

mongo0.example.com

##Modify the hosts file Modify the hosts file. If you are using a replica set then, obviously on mongo1 the 127.0.0.1 will point at localhost mongo1.example.com. For more information on setting up a replica set see Setting up a Replica Set on AWS EC2.

sudo nano /etc/hosts

127.0.0.1           localhost mongo0.example.com
52.51.12.62         mongo0.example.com

##Setup the DNS entry The hosts file entry is fine for local name resolution but to obtain a SSL certificate from Letsencrypt it will need to be able to resolve the name externally. So you will need to create a DNS entry (A or AAAA) to point at your server.

##Ports To optain the SSL certificate you will need to ensure that your server is accessable over port 80 and 443 as Letsencrypt will use this to connect to confirm that you control the domain.

##Getting the SSL certificate for your server.

###Installation To install the client, clone the repostiory from github.

sudo apt-get -y install git
sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt
cd /opt/letsencrypt

###Request the Certificate This process has got a lot easier over the last while.

./letsencrypt-auto certonly -d mongo0.example.com

You will be asked of you want letsencrypt to look for an entry in your web server.Presumable if this is just a database server then you will not need to install a web server like apache or nginx. In this case select verification option 2 Stand-alone Server. This should locate the file and create the certificates.

If you want to verify on a server with a web server you need to add the following to your default web site server block.

location ~ /.well-known {
        allow all;
}

Remember to restart your web server.

sudo systemctl reload nginx

##Preparing the Letsencrypt cert for use with MongoDB Letsencrypt will create the following certs:

cert.pem
chain.pem
fullchain.pem
privkey.pem

The first thing is to combine the privkey and cert into a single file mongodb.pem.

cd /etc/letsencrypt/live/mongo0.example.com
cat privkey.pem cert.pem > /etc/ssl/mongodb.pem

Then you need to download IdenTrust DST Root CA X3 from https://www.identrust.com/certificates/trustid/root-download-x3.html

Save it to a file named ca.crt adding -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

Then run:

printf "\n" >> ca.crt
cat /etc/letsencrypt/live/mongo0.example.com/chain.pem >> /etc/ssl/ca.crt

Then convert the crt file to a pem using:

openssl x509 -in /etc/ssl/ca.crt -out /etc/ssl/ca.pem -outform PEM

Just to make sure that everything is setup correctly run:

openssl verify -CAfile /etc/ssl/ca.pem /etc/letsencrypt/live/mongo0.example.com/mongodb.pem

You should get:

mongodb.pem: OK

##ca.pem

#Setup the Certs folder

chmod 600 /etc/ssl/ca.pem
chmod 600 /etc/ssl/mongodb.pem
chown -R mongodb:mongodb /etc/ssl/ca.pem
chown -R mongodb:mongodb /etc/ssl/mongodb.pem

##Configure MongoDB Edit the mongod.conf:

sudo nano /etc/mongod.conf

Specify the SSL locations. You may to specify a PEMKeyPassword if you got the cert from an different source than letsencrypt.

# network interfaces
net:
  port: 27017
  ssl:
     mode: requireSSL
     PEMKeyFile: /etc/ssl/mongodb.pem
     PEMKeyPassword:
     CAFile:     /etc/ssl/ca.pem

Restart MongoDB to make sure it is using the new settings:

sudo service mongod restart

Check that is is running:

tail -20  /var/log/mongodb/mongod.log

Try to connect. This should fail as it is now using a SSL connection is now required.

mongo

MongoDB shell version: 3.2.7
connecting to: test
2016-03-08T11:04:26.853+0000 E QUERY    [thread1] Error: network error while attempting to run command 'isMaster' on host '127.0.0.1:27017'  :
connect@src/mongo/shell/mongo.js:224:14
@(connect):1:6

exception: connect failed

Then log into the shell using ssl:

mongo --ssl -sslCAFile /etc/ssl/ca.pem --host mongo0.example.com --sslPEMKeyFile /etc/ssl/mongodb.pem

From inside the shell you can check that ssl is running:

db.serverStatus().security
{
        "SSLServerSubjectName" : "CN=mongo0.example.com",
        "SSLServerHasCertificateAuthority" : true,
        "SSLServerCertificateExpirationDate" : ISODate("2016-07-06T12:09:00Z")
}

peters/mongodb_ssl_with_letsencrypt.md