X.509 certificates

Authenticate an application with its client certificate, without a password. The user lives in the $external database and is named as the certificate subject.

Requirements

• A client certificate signed by a CA the node accepts with --tlsCAFile.
• A user allowed to create users.

Create the user

db.getSiblingDB("$external").runCommand({
  createUser: "CN=shop-api,OU=apps,O=Example",
  roles: [{ role: "readWrite", db: "shop" }],
});

Connect with the certificate

mongodb://node-01:27017/?tls=true&tlsCAFile=./ca.pem&tlsCertificateKeyFile=./shop-api.pem&authMechanism=MONGODB-X509

Check

Connect with the certificate and run db.runCommand({ connectionStatus: 1 }). The answer carries in authInfo.authenticatedUsers the certificate user, with its $external database.

Common problems

• Authentication fails because the user name is not the same as the certificate subject.
• The node does not ask for a certificate because it started without --tlsCAFile.

See also

• Authentication
• TLS and certificates