tls-x509-auth
Parent: mongosync · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-0d9513c00c8a
↓ Facts as markdownall context files
Source-anchored research for tls-x509-auth. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- Allowing invalid certificates is not a substitute for valid X.509 credentials: MongoDB documents that an invalid certificate can establish TLS under its allowInvalidCertificates setting but remains insufficient for X.509 authentication. (low confidence) [source]
Comparisons and alternatives
- A successful connection from one MongoDB client does not prove certificate compatibility with another. A mongodump user reported the error 'x509: certificate relies on legacy Common Name field, use SANs instead'; MongoDB documents that Go 1.15 and later require hostname SANs rather than CommonName-only validation. This is an adjacent diagnostic example, not a demonstrated mongosync failure. (high confidence) [source]
Facts and statements
- mongosync lists X.509 as supported and uses standard MongoDB connection strings for both source and destination clusters. MongoDB's 8.0 self-managed X.509 tutorial shows a mongosh URI with tls=true, tlsCertificateKeyFile, tlsCAFile, authSource=$external, and authMechanism=MONGODB-X509. The tutorial's example is for mongosh; the FAQ does not provide a tested deployment-specific mongosync URI. (high confidence) (verified as of 2026-10-20) [source]
- Atlas requires TLS. mongosync examples enable it with tls=true; mongodb+srv enables TLS by default, so an additional tls=true is unnecessary. (high confidence) [source]
- For self-managed X.509 client authentication, create a user in $external whose name is the certificate subject in RFC2253 form. Assign the migration permissions required on each endpoint; certificate authentication does not itself supply those roles. (high confidence) [source]
- tlsCertificateKeyFile carries the client certificate and private key; tlsCAFile supplies trust for validating the server. Do not place an Atlas-issued client certificate in tlsCAFile. Mongoose documents 'unable to get local issuer certificate' for that mistake; this is supporting client evidence, not a mongosync incident. (high confidence) [source]
- MongoDB's self-managed client certificate requirements include an unexpired certificate with digitalSignature key usage and clientAuth extended key usage. Keep migration client identities separate from cluster-member identities and review the deployment's O/OU/DC membership rules. (low confidence) [source]
- Let's Encrypt's announcement, updated March 16, 2026, schedules removal of clientAuth from the classic profile for February 11, 2026 and retirement of the tlsclient profile for July 8, 2026. For MongoDB client authentication, plan certificate issuance that satisfies clientAuth requirements; do not assume a public HTTPS certificate is usable as a migration client identity. (medium confidence) (verified as of 2026-03-16) [source]
- Delphix 25.0.0.0's shardedsource integration specifies allowTLS or preferTLS and separate client certificate inputs. That restriction belongs to its documented integration; it is not evidence that mongosync generally requires those server TLS modes. (low confidence) [source]
Children
- No children recorded.