• Security >
• Enable TLS for a Deployment

Enable TLS for a Deployment

For Ops Manager to monitor, deploy, or back up a MongoDB deployment that uses TLS, you must enable TLS for the Ops Manager project.

Considerations

Topics Not in Scope

A full description of Transport Layer Security, public key infrastructure, X.509 certificates, and Certificate Authorities is beyond the scope of this tutorial. This tutorial assumes prior knowledge of TLS/SSL and access to valid X.509 certificates.

Note

If you want to reset Authentication and SSL settings for your project, first unmanage any MongoDB deployments that Ops Manager manages in your project.

Procedures

Important

You must complete:

1. Set Existing Deployments to Use TLS, then
2. Enable SSL for the Project

before you click Review & Deploy.

Set Existing Deployments to Use TLS

Note

With the Client Certificate Mode setting introduced, you can set TLS certificates as optional or required for deployments in your project.

If you wish to enable TLS for existing MongoDB deployments in your Ops Manager project:

1

Click Deployment, then click the Processes tab, and then the Topology view.

2

On the line listing the process, click Modify.

3

Expand the Advanced Configuration Options section.

4

Set the TLS/SSL startup options.

1. Click Add Option to add each of the following options:

   Option	Required	Value
   sslMode	Required	Select requireSSL.
   sslPemKeyFile	Required	Provide the absolute path to the server certificate.
   sslPemKeyPassword	Required	Provide the PEM key file password if you encrypted it.
   sslFIPSMode	Optional	Select true if you want to enable FIPS mode.

2. After adding each option, click Add.

3. When you have added the required options, click Save.

Enable TLS for the Project

1

Navigate to Authentication & TLS Settings.

1. Click Deployment.
2. Click the Security tab.
3. Click Authentication & TLS.
4. Click Edit Settings.

2

On the Select Authentication Mechanisms screen, click Next.

If you wish to enable one or more Authentication Mechanisms for your Ops Manager project, select them and then click Next.

3

Specify the TLS Settings.

Field	Action
Enable TLS	Toggle this slider to Yes.
TLS CA File Path	The TLS Certificate Authority file is a .pem-format certificate file that contains the root certificate chain from the Certificate Authority. The MongoDB Agent uses this same Certificate Authority file to connect to every item in your deployment. Type the file path to the TLS Certificate Authority file on every host running a MongoDB process: Type the file path on all Linux hosts in the first box. Type the file path on all Windows hosts in the second box. This enables the net.ssl.CAFile setting for the MongoDB processes in the project.
Client Certificate Mode	Specify whether client TLS certificates are optional or required for every MongoDB deployment in the project. OPTIONAL You may choose which MongoDB deployments in this project use TLS-encrypted network connections. mongod tlsMode All Agents Connect with TLS allowTls, preferTls, or requireTls Yes None No REQUIRED Every MongoDB deployment in this project starts with TLS-encrypted network connections. All Agents must use TLS to connect to any MongoDB deployment.

Click Continue.

4

Configure the MongoDB Agents.

Field	Action
Agent Auth Mechanism	In this list, click X.509 Client Certificate.
MongoDB Agent Username	Type the MongoDB user name for the MongoDB Agent.
MongoDB Agent PEM Key File	Type the file path on the Agent hosts to the PEM key file. The first box is for all Linux Agent hosts. The second box is for all Windows Agent hosts.
MongoDB Agent PEM Key Password	Optional. If you encrypted the Agent’s PEM key file, enter its password in this box.

What if I had TLS certificates for Legacy Backup or Monitoring Agents?

• If you updated to the MongoDB Agent from deployments that used Automation, the MongoDB Agent manages the TLS settings.

• If you updated to the MongoDB Agent from deployments that did not use Automation but you had Backup Agents, Monitoring Agents, or both, you can set your Backup Agent and Monitoring Agent-specific settings during the Agent update or through the following procedure:

  1. Navigate to Deployment arrow right icon Agents arrow right icon Downloads & Settings arrow right icon Custom Configurations arrow right icon Edit Custom Configuration.
  2. Click pencil icon .
  3. Under the Backup Configurations section:
     1. Type the desired setting in the Setting box and its corresponding value in the Value box.
     2. To add more than one Setting, click the + Add Setting link. Another row appears.
     3. Repeat until all settings have been added.
  4. Under the Monitoring Configurations section:
     1. Type the desired setting in the Setting box and the corresponding value in the Value box.
     2. To add more than one Setting, click the + Add Setting link. Another row appears.
     3. Repeat until all settings have been added.

  You can click the trash icon to remove any settings that you have added.

5

Click Save to set your changes.

6

Click Review & Deploy to review your changes.

Ops Manager displays your proposed changes.

1. If you are satisfied, click Confirm & Deploy.
2. If you want to make further configuration changes, click Cancel. Click Modify for the cluster to make additional changes.

←   Configure the Connections to the Backing MongoDB Instances Configure Ops Manager Users for LDAP Authentication and Authorization  →

© MongoDB, Inc 2008-present. MongoDB, Mongo, and the leaf logo are registered trademarks of MongoDB, Inc.