Navigation

Configure Monitoring Agent for SSL

Overview

Cloud Manager supports SSL for encrypting the following connections made by Monitoring Agents:

  • Connections between the Monitoring Agents and MongoDB instances.
  • Connections between the Monitoring Agents and Cloud Manager.

Prerequisite

To configure the agent to use SSL, you must have a trusted CA certificate that signed the MongoDB instance’s certificate.

Procedures

Connections between Agents and MongoDB Instances

To use SSL for the Monitoring Agent’s connection to a MongoDB host, specify the host’s SSL settings when adding the host or by editing the host’s settings.

Note

Cloud Manager can manage SSL for you if you are using Automation for the deployment. With Automation, Cloud Manager prompts you for the certificates to use to connect to the deployment, when you enable SSL and then configures the agents appropriately. See: Enable SSL for a Deployment for more information.

1

Specify path to trusted CA certificate.

If your MongoDB deployment uses SSL, then you must configure the Monitoring Agent to use SSL. To configure the agent to use SSL, you must have a trusted CA certificate that signed the MongoDB instance’s certificate.

In the agent’s install directory, edit the monitoring-agent.config file to set sslTrustedServerCertificates field to the path of a file containing one or more certificates in PEM format. For example if you would use the following command to connect through the mongo shell:

mongo --ssl --sslCAFile /etc/ssl/ca.pem example.net:27017

Then you would set:

sslTrustedServerCertificates=/etc/ssl/ca.pem

By default, to connect to MongoDB instances using SSL requires a valid trusted certificate.

For testing purposes, however, you can set the sslRequireValidServerCertificates setting to false to bypass this check. When sslRequireValidServerCertificates is false, you do not need to specify the path to the trusted CA certificate in the sslTrustedServerCertificates setting, since Cloud Manager will not verify the certificates. This configuration is not recommended for production use as it makes connections susceptible to man-in-the-middle attacks.

For additional information on these settings, including client certificate support, see MongoDB SSL Settings.

2

Restart the agent.

Note

For additional information on SSL settings, including client certificate support, see MongoDB SSL Settings.

Connections between Agents and Cloud Manager

The Monitoring Agents always use SSL when connecting to Cloud Manager.