Configuring SSL in MongoDB on Windows Platform

Hi,

Recently I had a situation where in I was required to create a secure connection between mongodb server (mongod) and mongodb client (mongo). In order to establish the secure connection there is a need to start Mongodb in the following manner:

mongod --sslOnNormalPorts --sslPEMKeyFile <Location of PEM file of mongod>

If the above command is run is run on the free version of Mongodb then following error is generated:

error command line: unknown option sslOnNormalPorts

use --help for help

The main cause of this error is due to the fact that the normal free version of Mongodb does not support SSL functionality by default. In order to use SSL functionality following two methods could be used:

1.    Build Mongodb from its source using SSL option.

2.    Use Enterprise version of mongodb.

If you a looking forward to use the Enterprise version then there is no need to worry about SSL as this option will be by default present in the Enterprise version (as indicated in Mongodb official website http://docs.mongodb.org/manual/tutorial/configure-ssl/). However if you are trying to use SSL option without going for the Enterprise version then you need to manually build the source code of Mongodb using --ssl option.

Following text illustrates the steps needed to build Mongodb with SSL option from Mongodb source code.

System Requirements:

Following system requirements are needed to build Mongodb from source code:

1   .    Use a system with following minimum requirements:

a.    Windows 64/32 bit operating system.

b.    4GB RAM (RAM below this configuration will produce errors regarding insufficient memory).

c.    14GB free HDD space.

2   .    External library and software required are:

a.    Visual Studio Ultimate 2010 (or more). Visual Studio is needed as during the compilation process there is a need of few libraries and C/C++ compilers supplied along with Visual Studio.

b.    Python setup 32-bit. If you are using 64 bit system then also use 32 bit python (version used in this tutorial is 2.7.6). Python setup could be downloaded from http://www.python.org/downloads/

c.    Scons build tool (version used in this tutorial is 2.3.1). Scons could be downloaded from http://www.scons.org/

d.    Source code of Mongodb (version used in this tutorial is 2.4.9). Source code could be downloaded from http://www.mongodb.org/downloads. Below ‘Production Release (2.4.9)’ there is a link to download tgz|zip of source code. Download the zip for windows platform.

e.    OpenSSL 32/64 bit depending on the architecture of the system (version used in this tutorial is ‘OpenSSL 1.0.1e’). OpenSSL could be downloaded from http://slproweb.com/products/Win32OpenSSL.html. On this page select ‘Win32 OpenSSL v1.0.1f’ which is a ‘16MB Installer’.

Mongodb build process needs huge amount of resources (RAM, Disk and CPU) that is the reason if you take a configuration less than as mentioned above in point 1, then there are chances that the build process will fail with ‘Not enough space’ error.

Build Steps:

Steps: Follow following steps to proceed with the build process:

1.    Install Python 32-bit.

2.    Install Scons.

3.    Install OpenSSL.

4.    Install Visual Studio Ultimate.

5.  Add the location of (including) ‘Scripts’ folder inside python installation directory to system PATH. Copy the path upto ‘Scripts’ folder e.g. C:\Python27\Scripts and add it to your system path.

6. Now Open a command prompt and change the directory to the parent directory of the unzipped Mongodb source code. This is the place where you will find files after unzipping the source. This folder will have various directories like: build, buildscripts, debian, … , src.

7. Run following commands to build the executable from the source code. This process will take significant time and will use most of the CPU and nearly 4GB RAM (If the system configuration is less than as specified then the build process will fail).

Following command will create mongod.exe in the root folder of the unzipped Mongodb source.

scons --ssl --release --64 --extrapath=<OPENSSL-HOME>

This command will build drivers.

scons --ssl --release --64 --extrapath=<OPENSSL-HOME> mongoclient.lib

This command will build core modules.

scons --ssl --release --64 --extrapath=<OPENSSL-HOME>  core

In the above commands replace <OPENSSL-HOME> with the location of parent directory of OpenSSL installation, like if you install OpenSSL at ‘C:\OpenSSL-Win64’ then the above command will change to:

scons --ssl --release --64 --extrapath= C:\OpenSSL-Win64 

scons --ssl --release --64 --extrapath= C:\OpenSSL-Win64 mongoclient.lib

scons --ssl --release --64 --extrapath=C:\OpenSSL-Win64  core 

The process may take nearly 1 hour to complete the build process. Once the build process is complete open the root directory of the unzipped Mongodb source code, there you will find three main files: mongod.exe, mongo.exe and mongos.exe.

After the process is complete, you could successfully execute the command

mongod --sslOnNormalPorts --sslPEMKeyFile <Location of PEM file of mongod>

which was giving error earlier.

I hope this helps.

Regards

Rajeev

References:

http://docs.mongodb.org/manual/tutorial/configure-ssl/