Integration of MongoDB

This section lists the steps to integrate MongoDB with CipherTrust Manager.

• Prerequisites

• Configuration on CipherTrust Manager

• Configuration on MongoDB

Prerequisites

This section provides the prerequisites for integration of MongoDB with CipherTrust Manager.

• Ensure that the CipherTrust Manager is installed and configured. For more details, refer to the CipherTrust Manager Documentation.

• MongoDB communicates with the CipherTrust Manager using the KMIP interface. Ensure that the KMIP interface is configured on the CipherTrust Manager.

• IP address of the CipherTrust Manager and port of the KMIP interface must be accessible from the MongoDB system.

• CipherTrust Manager recognizes only registered KMIP clients. Ensure that each node of the MongoDB cluster is registered as a KMIP client on the CipherTrust Manager. Refer to KMIP Client Registration for more details.

Configuration on CipherTrust Manager

To configure the CipherTrust Manager, you need to perform the following steps:

1. Creating a Domain (optional)

2. Creating a User

3. Assigning User to a Group

4. Creating or Adding a CA (optional)

5. Registering a KMIP Client

6. Configuring the KMIP Interface

Creating a Domain (Optional)

Perform the following steps to be performed on CipherTrust Manager:

1. Navigate to Admin Settings > Domains.

2. Click Add Domain. The Add Domain page appears.

3. Specify the following information:

   • Name - Enter the domain name.

   • Admins - Select the admins (one or more) from the list available in the drop down. For example, admin.

   • Parent CA - Select parent CA as root CA.

   • Allow Subdomain User Management - Select this check box if you want to enable the sub-domain user management through this domain.

4. Click Save.

5. Switch to the newly created domain by clicking the top right on the current Domain Name.

Creating a User

Assigning User to a Group

Perform the following steps to add user to a group:

1. Click the ellipsis button (...) corresponding to the user that you created in the previous step.

2. Click Edit.

3. Click Group Memberships > Add Group.

4. In the search bar, type Key Admins and select the check box corresponding to it .

5. Click Add Group.

Creating or Adding a CA (Optional)

Registering a KMIP Client

Configuring the KMIP Interface

The KMIP interface can be configured through:

Further, You need to perform the following configuration on CipherTrust Manager specific to MongoDB:

Creating a Client Certificate

1. Log on to the CipherTrust Manager.

2. Navigate to the CA > Local CA and click on the name of the CA certificate you need to issue the certificate from.

3. Click on Issue Certificate.

4. Enter the Display Name, followed by Common Name.

   Note

   The Common Name of the certificate should be the Hostname/IP of CipherTrust Manager. In case of domains, the Common Name of the certificate should be of the format:

   <domain name>||<Hostname/IP>

   For more information on the format of Common Name of the certificate, refer to LDAP and Multi-Domain Client Usernames in KMIP Certificates.

5. Select the Algorithm and Size, and click Issue Certificate.

6. Save the Private Key and the CSR.

7. Select the Certificate Purpose as client, specify the validity of the certificate in days, and click Issue Certificate.

8. Download a copy of this certificate by clicking the ellipsis next to the certificate name.

Configuration on MongoDB

You can integrate MongoDB with the CipherTrust Manager using either of the following methods:

These options are available with MongoDB Enterprise only.

• Integrate Using a New Key

• Integrate Using an Existing Key

Integrate Using a New Key

1. Create a client certifcate. Refer to Creating a Client Certificate if you are auto-registering your KMIP client.

2. Concatenate the clientcertificate.pem and clientkey.pem files into a single file using:

   cat clientcertificate.pem clientkey.pem > client.pem
   

3. In case of domains, concatenate the Domain CA and Root CA into a single file using:

   cat domainCA.pem rootCA.pem > ca.pem
   

4. Start MongoDB manually using the following parameters to create an encryption key:

   mongod --enableEncryption 
   --kmipServerName <IP/Hostname of the CipherTrust Manager> 
   --kmipPort <KMIP port number of the CipherTrust Manager> 
   --kmipServerCAFile ca.pem 
   --kmipClientCertificateFile client.pem 
   --dbPath /var/lib/mongodb
   

   You will need to add the CipherTrust Manager’s hostname to the /etc/hosts file on your MongoDB server so that the name can be resolved to the IP address of the CipherTrust Manager.

Integrate Using an Existing Key

1. Create a client certifcate. Refer to Creating a Client Certificate if you are auto-registering your KMIP client.

2. Concatenate the clientcertificate.pem and clientkey.pem files into a single file using:

   cat clientcertificate.pem clientkey.pem > client.pem
   

3. In case of domains, concatenate the Domain CA and Root CA into a single file using:

   cat domainCA.pem rootCA.pem > ca.pem
   

4. Create a key on the CipherTrust Manager using the AES Algorithm. Set the state as Pre-Active.

   {
   "name": "Test_Key",
   "usageMask": 12,
   "algorithm": "aes",
   "meta": {
       "ownerId": "local|mongodb"
   },
   "state": "Pre-Active",
   "deactivationDate": "2023-10-02T14:24:37.436073Z",
   "protectStopDate": "2023-10-02T14:24:37.436073Z",
   "aliases": [
       {
       "alias": "altname2",
       "type": "string"
       },
       {
       "alias": "altname2:keysecure:gemalto:com",
       "type": "uri"
       }
   ]
   }
   

   e. Click POST.

5. Add the key management security options to /etc/mongod.conf.

   The MongoDB configuration file contains a security section. In this section, update the KMIP server name, certificate details, KMIP port number, and Key ID to use the CipherTrust Manager as a key management service.

   security:
   enableEncryption: true
   kmip:
       serverName: <IP/Hostname of the CipherTrust Manager>
       port: <KMIP port number of the CipherTrust Manager>
       serverCAFile: <Path to the CA certificate>
       clientCertificateFile: <Path to the client.pem> 
       keyIdentifier: <ID of the key created on the CipherTrust Manager>
   

6. Start MongoDB manually using the following parameters:

   mongod --enableEncryption 
   --kmipServerName <IP/Hostname of the CipherTrust Manager>
   --kmipPort <KMIP port number of the CipherTrust Manager> 
   --kmipServerCAFile ca.pem
   --kmipClientCertificateFile client.pem 
   --kmipKeyIdentifier <ID of the key created on the CipherTrust Manager>
   

   You will need to add the CipherTrust Manager’s hostname to the /etc/hosts file on your MongoDB server so that the name can be resolved to the IP address of the CipherTrust Manager.

After the service starts successfully, encryption is enabled and the integration is complete.