STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must only accept end entity certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

DISA Rule

SV-279386r1179520_rule

Vulnerability Number

V-279386

Group Title

SRG-APP-000427-DB-000385

Rule Version

MD8X-00-008000

Severity

CAT II

CCI(s)

• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Remove any certificate referenced that was not issued by an approved DOD certificate authority.

Contact the organization's certificate issuer and request a new certificate that is issued by a valid DOD certificate authorities.

Check Contents

To run MongoDB in TLS mode, obtain a valid certificate singed by a single CA.

Before starting the MongoDB database in TLS mode, verify the certificate used is issued by a valid DOD CA (openssl x509 -in <path_to_certificate_pem_file> -text | grep -i "issuer").

The certificates (pem files) used by MongoDB will be in the MongoDB configuration file net.tls section as shown below (default location /etc/mongod.conf).

Each of these must be inspected, when present, to make sure they comply with a DOD Issuer for the certificate.

net:
tls:
CAFile: <PEM file>
certificateKeyFile: <PEM file>
clusterFile: <PEM file>
clusterCAFile: <PEM file>
CRLFile: <PEM file>

When using MongoDB's native encryption at rest, the following must also be inspected in the security.kmip section of the MongoDB configuration file:

security:
kmip:
clientCertificateFile: <PEM file>
serverCAFile: <PEM file>

net.tls.CAFile
The .pem file that contains the root certificate chain from the CA. Specify the file name of the .pem file using relative or absolute paths.

net.tls.certificateKeyFile
The .pem file that contains both the TLS certificate and key.

net.tls.clusterFile
The .pem file that contains the x.509 certificate-key file for membership authentication for the cluster or replica set.

If there is any issuer present in the certificates being used that is not a DOD approved certificate authority, this is a finding.

net.tls.clusterCAFile
The .pem file that contains the root certificate chain from the CA used to validate the certificate presented by a client establishing a connection. Specify the file name of the .pem file using relative or absolute paths. net.tls.clusterCAFile requires that net.tls.CAFile is set.

net.tls.CRLFile
The .pem file that contains the Certificate Revocation List. Specify the file name of the .pem file using relative or absolute paths.

security.kmip.clientCertificateFile
Path to the .pem file used to authenticate MongoDB to the KMIP server. The specified .pem file must contain both the TLS/SSL certificate and key.

security.kmip.serverCAFile
Path to CA File. Used for validating secure client connection to KMIP server.

Vulnerability Number

V-279386

Documentable

False

Rule Version

MD8X-00-008000

Severity Override Guidance

To run MongoDB in TLS mode, obtain a valid certificate singed by a single CA.

Before starting the MongoDB database in TLS mode, verify the certificate used is issued by a valid DOD CA (openssl x509 -in <path_to_certificate_pem_file> -text | grep -i "issuer").

The certificates (pem files) used by MongoDB will be in the MongoDB configuration file net.tls section as shown below (default location /etc/mongod.conf).

Each of these must be inspected, when present, to make sure they comply with a DOD Issuer for the certificate.

net:
tls:
CAFile: <PEM file>
certificateKeyFile: <PEM file>
clusterFile: <PEM file>
clusterCAFile: <PEM file>
CRLFile: <PEM file>

When using MongoDB's native encryption at rest, the following must also be inspected in the security.kmip section of the MongoDB configuration file:

security:
kmip:
clientCertificateFile: <PEM file>
serverCAFile: <PEM file>

net.tls.CAFile
The .pem file that contains the root certificate chain from the CA. Specify the file name of the .pem file using relative or absolute paths.

net.tls.certificateKeyFile
The .pem file that contains both the TLS certificate and key.

net.tls.clusterFile
The .pem file that contains the x.509 certificate-key file for membership authentication for the cluster or replica set.

If there is any issuer present in the certificates being used that is not a DOD approved certificate authority, this is a finding.

net.tls.clusterCAFile
The .pem file that contains the root certificate chain from the CA used to validate the certificate presented by a client establishing a connection. Specify the file name of the .pem file using relative or absolute paths. net.tls.clusterCAFile requires that net.tls.CAFile is set.

net.tls.CRLFile
The .pem file that contains the Certificate Revocation List. Specify the file name of the .pem file using relative or absolute paths.

security.kmip.clientCertificateFile
Path to the .pem file used to authenticate MongoDB to the KMIP server. The specified .pem file must contain both the TLS/SSL certificate and key.

security.kmip.serverCAFile
Path to CA File. Used for validating secure client connection to KMIP server.

Check Content Reference

M

Target Key

5728