Test a connection from MongoDB to the KMES Series 3 with the configured TLS certificates by using OpenSSL
To confirm that the MongoDB client certificate enables a successful TLS connection to the KMIP port on the KMES Series 3, you can use OpenSSL. The following instructions depend on whether you used an external CA or a CA on the KMES to issue the MongoDB client certificate.
If you use an externally-issued MongoDB client certificate, you need to extract the client certificate and private key from the PKCS #12 file before connecting. You must also get the external CA certificate chain that signed the MongoDB client certificate and save it to a file.
The following instructions explain how to extract a signed certificate and private key from a PKCS #12 file and save them to their own files:
Run the following command to extract the private key and signed certificate from the PKCS #12 file and save them in a single PEM file called mongodb_cert_and_privatekey.pem. Note that the -nodes flag specifies that the private key should not be encrypted.
After you have the mongodb_cert_and_privatekey.pem file, you can extract the signed certificate and private key into separate files by using the following commands:
Now, run the following OpenSSL command to test a connection to the KMIP connection pair on the KMES Series 3, replacing <KMES-IP> with the IP address of the KMES Series 3 and adjusting the file names as necessary:
If the TLS handshake is successful, then the certificates were correctly configured on the KMES Series 3.
If you use a KMES-issued MongoDB client certificate, you need to extract the client certificate and private key from the PKCS #12 file before connecting. You must also get the root CA certificate that signed the MongoDB client certificate and save it to a file.
The following instructions explain how to extract a signed certificate and private key from a PKCS #12 file and save them to their own files:
Run the following command to extract the private key and signed certificate from the PKCS #12 file and save them in a single PEM file called mongodb_cert_and_privatekey.pem. Note that the -nodes flag specifies that the private key should not be encrypted.
After you have the mongodb_cert_and_privatekey.pem file, you can extract the signed certificate and private key into separate files by using the following commands:
Now, run the following OpenSSL command to test a connection to the KMES Series 3, replacing <KMES-IP> with the IP address of the KMES Series 3 and adjusting the file names as necessary:
If the TLS handshake is successful, then the certificates were correctly configured on the KMES Series 3.