STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

DISA Rule

SV-279412r1179403_rule

Vulnerability Number

V-279412

Group Title

SRG-APP-000915-DB-000310

Rule Version

MD8X-00-014100

Severity

CAT II

CCI(s)

CCI-004910 - Provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

Weight

Fix Recommendation

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile".

Example shown below:

net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/caToValidateClientCertificates.pem
ocsp:
enabled: true
responderURL: <your organization's OCSP responder URL>

Run the following commands on the file indicated by this key:

chmod 600 /etc/ssl/caToValidateClientCertificates.pem

Check Contents

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile".

Example shown below:

net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/caToValidateClientCertificates.pem
ocsp:
enabled: true
responderURL: <your organization's OCSP responder URL>

Run the following command on the file indicated by this key:

stat /etc/ssl/caToValidateClientCertificates.pem

If the output does not show file permissions of "-rw-------", this is a finding.

Vulnerability Number

V-279412

Documentable

False

Rule Version

MD8X-00-014100

Severity Override Guidance

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile".

Example shown below:

net:
tls:
mode: requireTLS
certificateKeyFile: /etc/ssl/mongodb.pem
CAFile: /etc/ssl/caToValidateClientCertificates.pem
ocsp:
enabled: true
responderURL: <your organization's OCSP responder URL>

Run the following command on the file indicated by this key:

stat /etc/ssl/caToValidateClientCertificates.pem

If the output does not show file permissions of "-rw-------", this is a finding.

Check Content Reference

Target Key

5728