STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must include only approved trust anchors in trust stores or certificate stores managed by the organization.

DISA Rule

SV-279411r1179400_rule

Vulnerability Number

V-279411

Group Title

SRG-APP-000910-DB-000300

Rule Version

MD8X-00-014000

Severity

CAT II

CCI(s)

• CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.

Weight

10

Fix Recommendation

Edit the MongoDB configuration file (default location /etc/mongod.conf) and add a key named "net.tls.CAFile" to configure the certificate trust.

Example shown below:

net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/caToValidateClientCertificates.pem
ocsp:
enabled: true
responderURL: <your organization's OCSP responder URL>

Check Contents

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile".

Example shown below:

net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/caToValidateClientCertificates.pem
ocsp:
enabled: true
responderURL: <your organization's OCSP responder URL>

If this key is not found, this is a finding.

Vulnerability Number

V-279411

Documentable

False

Rule Version

MD8X-00-014000

Severity Override Guidance

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile".

Example shown below:

net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/caToValidateClientCertificates.pem
ocsp:
enabled: true
responderURL: <your organization's OCSP responder URL>

If this key is not found, this is a finding.

Check Content Reference

M

Target Key

5728