search

10gen / mongo-orchestration

Apache License 2.0
7 stars 11 forks source link

Make MO client certificate configurable #298

Open ShaneHarvey opened 1 year ago

ShaneHarvey commented 1 year ago

When MO starts TLS clusters it always connects with the client certificate in $MONGO_ORCHESTRATION_HOME/lib/client.pem.

This doesn't make sense because 1) the server does not require client certificates by default so it's pointless for MO to connect with one and 2) the user can configure the cluster with other certificates via the sslParams, eg:

    "sslParams": {
        "sslCAFile": "/path/to/ca.pem", 
        "sslOnNormalPorts": true, 
        "sslPEMKeyFile": "/path/to/server.pem", 
        "sslWeakCertificateValidation": true
    }

MO should allow the user to configure the client certificate via sslParams too. The tlsCertificateKeyFile option can already be used to configure the mongo[ds] client cert. Perhaps MO can use that cert if it's provided and otherwise not use any client cert at all.