Enable SSL encryption to secure network connections at the transport layer. After SSL is enabled, install the SSL CA certificate on your application to ensure encrypted communication.
Prerequisites
The instance must be a replica set instance or a sharded cluster instance that uses cloud disks.
Usage notes
-
You can download the SSL CA certificate only from the ApsaraDB for MongoDB console.
-
SSL encryption increases CPU utilization. Enable SSL only when required, such as for connections over a public endpoint.
NoteConnections over an internal network are generally secure and do not require encryption.
-
After enabling SSL, if you modify or add an instance endpoint (such as a node or public endpoint), the new endpoint does not support SSL connections. To enable SSL for the new endpoint, update the server certificate.
-
By default, the instance supports both SSL and non-SSL connections. Enable SSL enforcement to allow only SSL connections.
NoteSSL enforcement requires version 7.0 (kernel 8.0.13 or later) or 8.0 (kernel 9.0.5 or later).
Impacts
Enabling, disabling, or updating SSL triggers an instance restart. Perform these operations during off-peak hours and ensure your application supports automatic reconnection.
Each node restarts in sequence, causing a transient disconnection of about 30 seconds per node. Instances with more than 10,000 collections may experience longer disconnections.
Enable SSL encryption
Enabling SSL restarts the instance. Each node experiences a transient disconnection of about 30 seconds. Schedule this operation accordingly and ensure your application supports automatic reconnection.
-
Go to the Replica Set Instances or Sharded Cluster Instances page. In the top navigation bar, select a resource group and a region, and then click the ID of the target instance.
-
In the left-side navigation pane, choose .
-
Turn on the switch next to SSL Status.
-
In the Enable SSL dialog box, choose whether to enable Forced SSL.
If you enable SSL enforcement, the instance rejects non-SSL connections.
NoteSSL enforcement is available only for instances that use cloud disks and run version 7.0 or 8.0, and meet the following kernel version requirements:
-
Version 7.0: The kernel version must be 8.0.13 or later.
-
Version 8.0: The kernel version must be 9.0.5 or later.
-
-
Click OK.
The instance status changes to Modifying SSL. When the SSL status changes to Enabled and the instance status returns to Running, SSL encryption is enabled.
Download SSL CA certificate
-
Go to the Replica Set Instances or Sharded Cluster Instances page. In the top navigation bar, select a resource group and a region, and then click the ID of the target instance.
-
In the left-side navigation pane, choose .
-
Click Download Certificate to save the SSL CA certificate to your computer.
Use the downloaded SSL CA certificate to encrypt database connections. Connect to an instance over SSL by using the mongo shell.
More operations
Update server certificate
The server certificate is valid for one year. Expired certificates prevent clients from establishing encrypted connections. Alibaba Cloud notifies you by SMS, email, and the Message Center before expiry, and automatically renews the certificate within a maintenance window. Customize the maintenance window through Schedule Event in scheduled events.
After automatic renewal, clients can connect without re-downloading or re-configuring the CA certificate. During the update, the ApsaraDB for MongoDB instance restarts, causing a transient disconnection of about 30 seconds per node. Customize the update time through a scheduled event and ensure your application supports automatic reconnection.
-
Go to the Replica Set Instances page. In the top navigation bar, select a resource group and a region, and then click the ID of the target instance.
-
In the left-side navigation pane, choose .
-
Click Update Certificate.
-
In the Update SSL dialog box, click OK.
The instance status changes to Modifying SSL. When the status returns to Running, the server certificate is successfully updated.
Disable SSL encryption
Disabling SSL restarts the ApsaraDB for MongoDB instance. Each node experiences a transient disconnection of about 30 seconds. Schedule this operation during off-peak hours and ensure your application supports automatic reconnection.
-
Go to the Replica Set Instances page. In the top navigation bar, select a resource group and a region, and then click the ID of the target instance.
-
In the left-side navigation pane, choose .
-
Turn off the switch next to SSL Status.
-
In the Disable SSL dialog box, click OK.
The instance status changes to Modifying SSL. When the status returns to Running, SSL encryption is disabled.
API reference
|
API |
Description |
|
Queries SSL settings for an ApsaraDB for MongoDB instance. |
|
|
Modifies the SSL configuration of an ApsaraDB for MongoDB instance. |