OpenControls Logo

STIG Viewer

STIGViewer Support

MongoDB must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279412MD8X-00-014100SV-279412r1179403_ruleCCI-004910medium
Description
A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.
STIGDate
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide2026-02-20

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-09Cryptographic Key Management
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (6) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IA-5(1)Password-based Authentication
1.00
IA-5(2)Public Key-based Authentication
1.00
SC-17Public Key Infrastructure Certificates
1.00
SC-28Protection of Information at Rest
1.00
SC-28(1)Cryptographic Protection
1.00
SC-28(3)Cryptographic Keys
1.00
CCI1 mapping
CCI-004910
1.00

Details

Check Text (C-279412r1179403_chk)

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile". Example shown below: net: tls: mode: requireTLS certificateKeyFile: /etc/ssl/mongodb.pem CAFile: /etc/ssl/caToValidateClientCertificates.pem ocsp: enabled: true responderURL: <your organization's OCSP responder URL> Run the following command on the file indicated by this key: stat /etc/ssl/caToValidateClientCertificates.pem If the output does not show file permissions of "-rw-------", this is a finding.

Fix Text (F-83870r1179402_fix)

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile". Example shown below: net: tls: mode: requireTLS certificateKeyFile: /etc/ssl/mongodb.pem CAFile: /etc/ssl/caToValidateClientCertificates.pem ocsp: enabled: true responderURL: <your organization's OCSP responder URL> Run the following commands on the file indicated by this key: chmod 600 /etc/ssl/caToValidateClientCertificates.pem