MongoDB must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile".

Example shown below:

net: tls: mode: requireTLS certificateKeyFile: /etc/ssl/mongodb.pem CAFile: /etc/ssl/caToValidateClientCertificates.pem ocsp: enabled: true responderURL: <your organization's OCSP responder URL>

Run the following command on the file indicated by this key:

stat /etc/ssl/caToValidateClientCertificates.pem

If the output does not show file permissions of "-rw-------", this is a finding.

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "net.tls.CAFile".

Example shown below:

net: tls: mode: requireTLS certificateKeyFile: /etc/ssl/mongodb.pem CAFile: /etc/ssl/caToValidateClientCertificates.pem ocsp: enabled: true responderURL: <your organization's OCSP responder URL>

Run the following commands on the file indicated by this key:

chmod 600 /etc/ssl/caToValidateClientCertificates.pem