Sitecore connecting to MongoDB using SSL

After configuring valid certificates in MongoDB it is time to establish the communication from Sitecore to MongoDB, and unfortunately Sitecore does not communicate with Mongo using SSL Out of the box.\n\nI found a good article that explain how to achieve it, however, I don’t have any experience on it and had to ask for help to my colleague Leonardo Faggiani\n\nOur first successful attempt was using a PFX file that requires a password but the problem was\n\n> Nobody wants to expose password in config files, specially for a PFX file!\n\nSo, we started thinking about using the Windows Certificate Store to retrieve the certificate! And in order to accomplish that, we need to extend UpdateMongoDriverSettingsProcessor class to update Mongo Driver Settings with the SSL certificate.\n\npublic class EnableSSL : UpdateMongoDriverSettingsProcessor – This method allow users to turn on/off the SSL settings.\n[code language=”csharp”] \nprivate bool UseSSL() \n{ \nstring value = Settings.GetSetting(“UseSSL”); \nreturn !string.IsNullOrEmpty(value) && Convert.ToBoolean(value); \n}\n\nSelf-explaned method \nprivate StoreName? FindStoreName() \n{ \nStoreName storeName = StoreName.My; \ntry \n{ \nstoreName = (StoreName)Enum.Parse(typeof(StoreName), Settings.GetSetting(“SSLCertificateStoreName”)); \n} \ncatch (Exception e) \n{ \nLog.Error(“Error loading store certificate: Settings.GetSetting(SSLCertificateStoreName) ” + e.Message, this); \nreturn null; \n}\n\nreturn storeName; \n} \n[/code]\n\nThe Certificate Store must be opened in order to find the certificate.\n\n[code language=”csharp”] \nprivate X509Certificate2 FindX509Certificate2() \n{ \nStoreName? nullableStoreName = FindStoreName(); \nif (nullableStoreName == null) return null;\n\nX509Certificate2 firstCertificate = null;\n\nStoreName storeName = (StoreName)nullableStoreName; \nX509Store store = new X509Store(storeName, StoreLocation.LocalMachine);\n\ntry \n{ \nstore.Open(OpenFlags.MaxAllowed);\n\nvar certificates = store.Certificates.Find(X509FindType.FindByThumbprint, Settings.GetSetting(“SSLCertificateThumbprint”), false); \nfirstCertificate = certificates.Count > 0 ? certificates\[0\] : null;\n\nif (firstCertificate == null) \nLog.Warn(“Cannot find certificate with thumbprint ” + Settings.GetSetting(“SSLCertificateThumbprint”), this); \n} \nfinally \n{ \nstore.Close(); \n}\n\nreturn firstCertificate; \n} \n[/code]\n\nOverridden method join all the pieces\n\n[code language=”csharp”] \npublic override void UpdateSettings(UpdateMongoDriverSettingsArgs args) \n{ \nif (UseSSL()) \n{ \nX509Certificate2 x509Certificate2 = FindX509Certificate2();\n\nif (x509Certificate2 == null) return;\n\nargs.MongoSettings.SslSettings = new SslSettings(); \nargs.MongoSettings.SslSettings.ClientCertificates = new\[\] { x509Certificate2 }; \nargs.MongoSettings.SslSettings.CheckCertificateRevocation = false; \nargs.MongoSettings.SslSettings.EnabledSslProtocols = SslProtocols.Tls12; \nargs.MongoSettings.UseSsl = true; \n} \n} \n[/code]\n\nFinally, we need a .config file in order to add those configurations and push the code in the Sitecore’s pipeline\n\n> \n> \n>   \n> \n>     \n> \n>       \n> \n>         <patch:attribute name=”value”>true\n> \n>       \n> \n>       \n> \n>         <patch:attribute name=”value”>My\n> \n>       \n> \n>       \n> \n>         <patch:attribute name=”value”>33d567ffc26697605c31ebd4bd87c7254128f049\n> \n>       \n> \n>     \n> \n>     \n> \n>       \n> \n>         <processor type=”Custom.MongoDriver.EnableSSL, Custom.MongoDriver” />\n> \n>       \n> \n> \

    \n> \n> _\n> _\n\nOnce we’ve applied it to the Sitecore installation, it didn’t work from beginning and after couple hours troubleshooting here’s what we found to solve it\n\n## The Solution\n\n### Open Certificate Store\n\n1. Open a Command Prompt window, and type mmc then press Enter \n2. On the File menu, click Add/Remove Snap In\n\n<figure class="aligncenter size-large"><img decoding="async" src="/media/wp/2020/05/mmc-file-add-remove-snap-in-blog-vinicius-deschamps.jpg" alt="MMC File Add Remove Snap-in Blog Vinicius Deschamps" class="wp-image-5582" loading="lazy">\n\n3. Double click Certificates\n\n<figure class="aligncenter size-large"><img decoding="async" src="/media/wp/2020/05/add-or-remove-snap-ins-certificates-blog-vinicius-deschamps.jpg" alt="Add or Remove Snap-ins Certificates Blog Vinicius Deschamps" class="wp-image-5558" loading="lazy">\n\n4. Select Computer Account, and click Next\n\n<figure class="aligncenter size-large"><img decoding="async" src="/media/wp/2020/05/select-computer-blog-vinicius-deschamps.png" alt="Select Computer Blog Vinicius Deschamps" class="wp-image-5684" loading="lazy">\n\n5. Select Local Computer, and click Finish then click OK to exit the Snap-in window\n\n<figure class="aligncenter size-large"><img decoding="async" src="/media/wp/2020/05/select-computer-local-computer-blog-vinicius-deschamps.jpg" alt="Select Computer Local Computer Blog Vinicius Deschamps" class="wp-image-5588" loading="lazy">\n\n### Manage Private Key Permissions\n\nAssuming you have the private key installed already, and Certificate Store still open, please follow the steps below\n\n1. In the left pane of MMC, expand Certificates (Local Computer) node, expand the Personal node, and then select the Certificates subfolder\n\n<figure class="aligncenter size-large"><img decoding="async" src="/media/wp/2020/05/mmc-personal-certificates-blog-vinicius-deschamps.png" alt="MMC Personal Certificates Blog Vinicius Deschamps" class="wp-image-5682" loading="lazy">\n\n2. In the right pane, look for your certificate – in my case it is NLCVD2LAP @ Valtech – right-click in the certificate, choose All Tasks, and then choose Manage Private Keys.\n\n<figure class="aligncenter size-large"><img decoding="async" src="/media/wp/2020/05/mmc-certificates-manage-private-keys-blog-vinicius-deschamps.png" alt="MMC Certificates Manage Private Keys Blog Vinicius Deschamps" class="wp-image-5681" loading="lazy">\n\nA Permissions window shows up, and you have to add the user that is running the Application Pool of your Sitecore instance which could be either ApplicationPoolIdentity, NetworkService or a special account just for that.\n\n3. Click Add in the Permissions window, and let’s grant privileges to our Application Pool user\n\n<figure class="aligncenter size-large"><img decoding="async" src="/media/wp/2020/05/select-user-or-groups-certificate-private-key-blog-vinicius-deschamps.png" alt="Select User or Groups Certificate Private Key Blog Vinicius Deschamps" class="wp-image-5686" loading="lazy">\n\n> Please note that in my case the Sitecore was running using the ApplicationPoolIdentity using an ApplicationPool named sc82u3\n\n4. Ensure the permissions are Full Control and Read for testing purposes only, then click Ok\n\n<figure class="aligncenter size-large"><img decoding="async" src="/media/wp/2020/05/permissions-certificate-private-key-blog-vinicius-deschamps.png" alt="Permissions Certificate Private Key Blog Vinicius Deschamps" class="wp-image-5683" loading="lazy">\n\nOnce we have done the permission stuff, the solution provided by Leonardo, started to work right away!\n\nI hope you liked it, and thanks for reading!\n\nAnd I’ll see you on my next post!