Skip to main content

Configuring a ProfileUnity MongoDB cluster to force TLSv1.2

Steven Hajek
  • Created:
  • Updated:

For a MongoDB cluster, by default, the intra-cluster communications between MongoDB nodes is unencrypted.  This article explains the process to enable and force TLSv1.2 for all MongoDB traffic.

 

NOTES:

  1. TLS connections will be supported out of the box for all operations in 6.8.5.
  2. This article requires you already have an existing ProfileUnity Console cluster and know what the existing prou_services password is currently set to.
  3. If you are using FlexDisk VMDK FlexApps or User Data Disks / VMDK ProfileDisks STOP NOW - this process does not support FlexDisk until 6.8.5.
  4. Until 6.8.5, enabling TLS connections for MongoDB may cause any future cluster operations like removing/adding nodes to fail.  Make sure your cluster is fully built-out, as needed, prior to enabling TLS.
  5. This process requires you to have new and valid certificates created to match the FQDN (or wildcard) of each of the ProU Console nodes imported into the Personal cert store of the Computer Account on the respective machines.  In order to support self-signed/untrusted certificates instead, you must import each node's full cert chain (minus the private key) into each other node's "Trusted Root Certificate Authority" store of the Computer Account so that each node explicitly trusts each other node's certificate.

INSTRUCTIONS:

  1. Starting with a healthy ProfileUnity Console cluster - Shutdown, snapshot and power back on each node, one at a time to maintain redundancy.
  2. Connect to the first cluster node and open "Services.msc".  Stop the Liquidware ProfileUnity service, stop and disable the Liquidware FlexDisk service and then stop the MongoDB service.
  3. Run "mmc.exe" and add in the Certificates snap-in, selecting the Computer Account on the Local Machine.
  4. Expand the left bar, right click Personal, All tasks, Import.  Browse to this nodes new / valid cert chain and complete the import.  Make note of the "Subject" of the certificate.
    **If using the default untrusted "Liquidware Certificates", now is when you would export the chain from the other two nodes and import them into the "Trusted Root Certification Authority" store instead of the "Personal" store.
  5. Download and edit the attached "mongodb.cfg" file and replace: certificateSelector: subject=Liquidware Certificate with: certificateSelector: subject=YourNewCertSubjectHere  Then place the edited config into "C:\Program Files\MongoDB".  (Leave the default if exporting the certs from the other two nodes instead of using a new/real cert.)
  6. Download and edit the attached "settings.json" file and replace the example password and servernames in the mongodb:// connection string with your actual prou_services account password and cluster node FQDN's.  Then place the edited file into "C:\Program Files (x86)\Liquidware Labs\ProfileUnity".
  7. Back in "Services.msc", start the MongoDB service and then start the Liquidware ProfileUnity Service.  Click Refresh and make sure both services are still "Running".
  8. Repeat steps 2-7 on each other node, one at a time.  After all nodes are complete, you should be able to get to the login page for each node's respective web console URL.

 

Related articles