TLS and certificates

The PKI the first node creates, TLS on the client port and mutual TLS between nodes.

TeselaDB encrypts all traffic from the first start, with its own implementation of TLS 1.3 and X.509.

The cluster PKI

The first node creates a certificate authority (pki/ca.pem) and its certificate (pki/node.pem). Each node that joins with a token receives a certificate signed by that CA. Between nodes only TLS 1.3 with certificates on both ends is spoken: a node without a certificate from the CA cannot talk to the cluster.

Client port

The client port requires TLS (--tlsMode requireTLS by default) and accepts TLS 1.2 and 1.3. To use your own certificates, for example those of your corporate CA, use the MongoDB options:

Shell

teseladb start --tlsCertificateKeyFile /etc/teseladb/server.pem --tlsCAFile /etc/teseladb/ca.pem

With --tlsCAFile, the node asks for a client certificate; --tlsAllowConnectionsWithoutCertificates lets clients without one in. --tlsCRLFile rejects revoked certificates.

Rotate certificates

Shell

teseladb admin cert rotate

or db.adminCommand({ rotateCertificates: 1 }) to reload the configured files. Neither restarts the node.

PreviousMonitoring NextAuthentication