MongoDB connections

DataMasque masks MongoDB collections in place.

• Required privileges
• Encrypted connections
  • Publicly trusted certificates (e.g. MongoDB Atlas)
  • Custom or private CAs
  • Rotating a certificate

Required privileges

A DataMasque connection for MongoDB requires:

• A user with readWrite role on the target database.

use admin
db.createUser({
  user: "<connection user>",
  pwd: "<password>",
  roles: [{ role: "readWrite", db: "<target database>" }]
})

MongoDB connections use the following parameters:

• Host: The hostname of the MongoDB server.
• Port: The MongoDB server port (default: 27017).
• Database: The database to connect to and mask.
• User / Password: Credentials for authentication. Optional when the MongoDB instance does not require authentication. If a user is provided, a password is also required.
• Authentication Database: The database used to authenticate the supplied user. Defaults to admin.
• Enable TLS/SSL: Connect to the server using TLS. When enabled without a CA certificate, the system CA trust store is used for verification.
• MongoDB CA Certificate: An optional CA certificate used to trust a custom or private CA (for example, the Amazon RDS CA required by Amazon DocumentDB). Shown under Advanced Settings once TLS is enabled. See MongoDB Encrypted Connections.
• Direct Connection: Connect directly to a single MongoDB instance rather than discovering members of a replica set.

Encrypted connections

DataMasque supports encrypted connections to MongoDB databases. Enable TLS/SSL on the connection to connect over TLS.

Publicly trusted certificates (e.g. MongoDB Atlas)

When TLS is enabled without a CA certificate, the system CA trust store is used to verify the server. This is sufficient for any server that presents a publicly trusted certificate, such as MongoDB Atlas or Azure Cosmos DB — no certificate upload is required. Simply enable TLS/SSL and leave the MongoDB CA Certificate unset.

Custom or private CAs

To trust a server whose certificate is not publicly trusted, upload a CA certificate through the Files interface and select it as the MongoDB CA Certificate under Advanced Settings on the connection. The certificate is only used when TLS is enabled; selecting one while TLS is disabled is rejected.

The certificate must be uploaded as a .zip file containing a single ca.pem file:

File Name	Description
ca.pem	The certificate(s) used to verify the server, in PEM format.

What ca.pem should contain depends on how the server's certificate was issued:

The server certificate is…	Put this in ca.pem
Self-signed	The server's own certificate (it acts as its own trust anchor).
Issued by a private/internal CA	That CA's certificate (the issuer).
Issued via one or more intermediate CAs	The full chain: the root CA plus every intermediate CA, concatenated into ca.pem.

If you are unsure, include the full chain (the root CA and all intermediates). ca.pem must be in PEM format, i.e. one or more -----BEGIN CERTIFICATE----- blocks.

Client certificates (mutual TLS) are not supported; the uploaded certificate is used only to verify the server.

This is the trust path required by Amazon DocumentDB, which presents a certificate signed by the Amazon RDS CA. Download the Amazon RDS CA bundle, package it as ca.pem inside a .zip, and select it on the connection. See AWS's documentation: https://docs.aws.amazon.com/documentdb/latest/developerguide/security.encryption.ssl.html.

Rotating a certificate

Connection fileset names must be unique, so re-uploading a file with the same name is rejected. To rotate the CA certificate a connection uses:

1. Upload the new certificate as a new fileset (with a new, unique name).
2. Edit the connection and select the new certificate as the MongoDB CA Certificate.
3. Delete the old fileset from the Files page.