获取 TLS 服务器证书

Obtain server certificates to enable TLS encryption for your self-managed MongoDB replica set deployments.

重要

These steps apply to self-managed MongoDB deployments. MongoDB Atlas clusters use TLS by default. If you use Cloud Manager or Ops Manager, configure TLS through your deployment management tool.

开始之前

在开始之前，请确保您具有以下信息和资源：

您有一个自管理的 MongoDB 副本集部署，并希望使用 TLS 对其进行保护。
您的部署中至少启用了一个管理员用户，以在后续教程中验证 TLS 连接。如果要启用 X.509 客户端身份验证，则管理员用户必须至少具有 userAdmin 角色，才能在 $external 数据库中创建和修改用户。
You have a hostname for each node in your deployment, such as mongo0.example.com, mongo1.example.com, and mongo2.example.com. If you are using a public CA, you must have a registered domain name that corresponds to these hostnames.
You have OpenSSL installed on your machine.
If you are planning on using a public CA, such as Let's Encrypt or DigiCert, you know which public CA you are using. If you are planning on using a private CA, you have access to your organization's PKI information. The process for obtaining certificates might be different based on the CA you use. However, you must end with the same .pem files described in the final result section of this tutorial.
您已打开了首选的命令行界面。
You know your deployment TLS configuration requirements and whether your certificates need clientAuth EKU based on the TLS Planning page.

步骤

本教程为部署中的第一个节点创建一个名为 mongo0.pem 的证书。为其他节点生成证书时，请在文件名中指定。示例，将第一个从节点(secondary node from replica set)的证书命名为 mongo1.pem。

CA 类型

最终结果

在本教程结束时，/etc/ssl/mongodb 中有以下 .pem 个文件：

对于每个节点，都有一个包含该节点证书和私钥的 .pem 文件，例如 mongo0.pem、mongo1.pem 和 mongo2.pem。
对于整个部署，您拥有为每个节点颁发证书的中间 CA 证书，例如 ca.pem。

后续步骤

要了解如何为自管理的 MongoDB 部署配置 TLS，请继续阅读下一个教程：为自管理的部署配置 TLS。