OpenControls Logo

STIG Viewer

STIGViewer Support

MongoDB must include only approved trust anchors in trust stores or certificate stores managed by the organization.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279411MD8X-00-014000SV-279411r1179400_ruleCCI-004909medium
Description
Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.
STIGDate
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide2026-02-20

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-08Public Key Infrastructure (PKI)
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (27) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-7Unsuccessful Logon Attempts
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
CM-6Configuration Settings
1.00

+17 more (top 10 by confidence shown)

CCI1 mapping
CCI-004909
1.00

Details

Check Text (C-279411r1179400_chk)

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile". Example shown below: net: tls: mode: requireTLS certificateKeyFile: /etc/ssl/mongodb.pem CAFile: /etc/ssl/caToValidateClientCertificates.pem ocsp: enabled: true responderURL: <your organization's OCSP responder URL> If this key is not found, this is a finding.

Fix Text (F-83869r1179399_fix)

Edit the MongoDB configuration file (default location /etc/mongod.conf) and add a key named "net.tls.CAFile" to configure the certificate trust. Example shown below: net: tls: mode: requireTLS certificateKeyFile: /etc/ssl/mongodb.pem CAFile: /etc/ssl/caToValidateClientCertificates.pem ocsp: enabled: true responderURL: <your organization's OCSP responder URL>