Rotate certificates

Change a node's certificates without restarting it, before they expire or when you suspect a key has leaked.

Requirements

• Access to teseladb admin on the node, or a user that can run rotateCertificates.

Cluster PKI certificate

teseladb admin cert rotate

The node generates a new key and certificate, signed by the cluster CA.

Your own certificates

If the node uses your files (--tlsCertificateKeyFile), replace them on disk and ask the node to load them again:

db.adminCommand({ rotateCertificates: 1 });

Check

Connections opened after the rotation get the new certificate, and the ones that were already open keep working with the old one until they close.

Common problems

• rotateCertificates fails with InvalidSSLConfiguration (140) because a file is not valid. The message names the file.

See also

• TLS and certificates
• teseladb admin cert