1

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients

Let's say I create certificate and user for admin:

subject: CN=admin
issuer: CN=MongoDB Issuing CA

-> db.createUser({user: "CN=admin"})

When I provide the certificate to another person, then he would be able to connect to all our systems, i.e. all the test and development databases as well as all production databases. This I like to avoid.

What is the common practice to separate them? In principle there are two possibilities.

Define more specific certificate subject names

subject: CN=admin,DC=Application1,DC=Prod
issuer: CN=MongoDB Issuing CA
-> db.createUser({user: "CN=admin,DC=Application1,DC=Prod"})

subject: CN=admin,DC=Application1,DC=Test
issuer: CN=MongoDB Issuing CA
-> db.createUser({user: "CN=admin,DC=Application1,DC=Test"})

subject: CN=admin,DC=Application2,DC=Prod
issuer: CN=MongoDB Issuing CA
-> db.createUser({user: "CN=admin,DC=Application2,DC=Prod"})

subject: CN=admin,DC=Application2,DC=Test
issuer: CN=MongoDB Issuing CA
-> db.createUser({user: "CN=admin,DC=Application2,DC=Test"})

Create dedicated CA for each database

subject: CN=admin
issuer: CN=MongoDB Application1 Issuing CA
-> db.createUser({user: "CN=admin"})

subject: CN=admin
issuer: CN=MongoDB Application1 Test Issuing CA
-> db.createUser({user: "CN=admin"})

subject: CN=admin
issuer: CN=MongoDB Application2 Issuing CA
-> db.createUser({user: "CN=admin"})

subject: CN=admin
issuer: CN=MongoDB Application2 Test Issuing CA
-> db.createUser({user: "CN=admin"})

What are the pros and cons of these two approaches?

0

You must log in to answer this question.