Spring boot mongo tls cert

Viewed 1176

I have set up TLS in mongod.conf. I need to use spring boot to connect to my mongo which requires tls now. In MongoCompass, I set Certificate Authority, Client Certificate & Client Private Key to root-ca.pem, test.pem & test.pem accordingly and I am able to connect. How can i specify the root-ca.pem & test.pem correctly in mongoclientoptions to connect to my mongo?

This is my mongod.conf

# network interfaces
net:
  port: 27017
  bindIp: 127.0.0.1
  tls:
    mode: requireTLS
    certificateKeyFile: C:\TLSServerMongo\test.pem
    CAFile: C:\TLSServerMongo\root-ca.pem
    clusterFile: C:\TLSServerMongo\test.pem
    allowInvalidCertificates: true
    FIPSMode : false

This is my mongoclientoptions

   @Bean
    public MongoClientOptions mongoClientOptions() {
        MongoClientOptions.Builder mongoClientOptions = MongoClientOptions.builder().sslInvalidHostNameAllowed(true).sslEnabled(true);
        try {
//            String fileName = directory + RDS_COMBINED_CA_BUNDLE;
            String fileName = "C:\\TLSServerMongo\\test.pem";
            InputStream is = new FileInputStream(fileName);
            // You could get a resource as a stream instead.

            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            X509Certificate caCert = (X509Certificate) cf.generateCertificate(is);

            TrustManagerFactory tmf = TrustManagerFactory
                    .getInstance(TrustManagerFactory.getDefaultAlgorithm());
            KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
            ks.load(null); // You don't need the KeyStore instance to come from a file.
            ks.setCertificateEntry("caCert", caCert);

            tmf.init(ks);

            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, tmf.getTrustManagers(), null);
            mongoClientOptions.sslContext(sslContext);
        } catch (Exception e) {
            LOGGER.error(e.getMessage());
        }


        return mongoClientOptions.build();
    }

This is my MongoClient

  public @Bean
    MongoClient mongoClient() {
        List<MongoCredential> allCred = new ArrayList<>();
        allCred.add(MongoCredential.createCredential(username, database, password.toCharArray()));
        MongoClient client = new MongoClient((new ServerAddress(this.myHost, this.myPort)), allCred, mongoClientOptions());
        client.setWriteConcern(WriteConcern.ACKNOWLEDGED);

        return client;
    }
1 Answers

It will be a Good idea to create one single .jks file as a cert and use it in spring boot mongo client...

pls refre to this for converting your .pem cert into JKS Convert .pem files to .jks

Once you have the .jks in your keystore on your system then we can use it or you may follow this example to connect using jks...

Connecting to MongoDB from spring boot app using ssl

or https://dba.stackexchange.com/questions/206462/how-to-configure-ssl-mongodb-connection-in-yml-file-spring-boot

Hope it helps!

Related