Is this behaviour of MongoDB secure?

  1. Database TLS is turned on and the client's cert .pem is loaded on the machine. When the client-side app is launched and communicating with the database, the cert works with TLS and is able to save data from app to database.

  2. However, using MongoDB Compass, I turn on TLS but did not load the client-side cert, and tick the option "allow invalid cert", and Compass is able to log into the database.

  • Where was "allow invalid cert"? In the Compass tool or somewhere else?
    – schroeder
    Jul 28 at 17:37
  • and have you looked up Mongo's documentation on this? mongodb.com/docs/manual/tutorial/configure-ssl-clients/…
    – schroeder
    Jul 28 at 17:38
  • This is the part I don't quite understand. If server is properly hardened, should mongo compass still allow user somehow connect to it? Jul 29 at 4:54
  • I'm afraid that I don't understand what you are asking. And you have not answered my first question. Can you clarify or rephrase your question?
    – schroeder
    Jul 29 at 8:03
  • Are you sure that you activated TLS Client Authentication on the MongoDB side? Your database logs should tell you how the client is authenticated. The client may be ready for certificate authentication, but is the server doesn't ask for it it won't do it. Jul 29 at 9:32


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.