9

I have successfully encrypted the communication in mongoDB but when I try to enable the data encryption I'm getting errors. I am using the enterprise edition of mongoDB with version 3.2.4. I get the following message in the console:

ERROR: child process failed, exited with error number 14

But when I look at the logs I see detailed error as follows:

Unable to retrieve key .system, error: there are existing data files, but no valid keystore could be located.
Fatal Assertion 28561

following is the snippet of my config file:

# enable authentication
security:
  authorization: enabled
  enableEncryption: true
  encryptionKeyFile: /home/test/mongodb-keyfile

It works fine without the enableEncryption, and encryptionKeyFile parameters. Could anyone explain what i'm missing here? thanks!

9
  • 3
    I have no idea about MongoDB encryption, but I would think that you can't enable encryption of an existing database. Perhaps you can create an empty database with enabled encryption and then copy all data to the encrypted database.
    – Artjom B.
    Commented Apr 6, 2016 at 20:07
  • 1
    @Gurkha Well it would help if you understood it. If you want data encryption then you are going to have to start with a blank data directory. So backup the data first, delete the current data directory and set new options. Then you can restore data and continue. The same process applies as to switching storage engines. It's just not possible to switch those options and have the database just do it for you.
    – Neil Lunn
    Commented Apr 11, 2016 at 6:20
  • Take a look - docs.mongodb.org/manual/tutorial/configure-encryption/… ... Also, you need to make sure your database is running on WiredTiger storage engine. Commented Apr 11, 2016 at 6:28
  • @NeilLunn I'm trying to encrypt a brand new instance of MongoDB so the data directory is empty.
    – Gurkha
    Commented Apr 11, 2016 at 12:33
  • @StanleyKirdey the version of mongoDB I'm using uses WiredTiger storage engine by default. I also tried to manually specify it but without luck. And the link you provided, that exactly what I did and it says valid keystore not found. :(
    – Gurkha
    Commented Apr 11, 2016 at 12:34

1 Answer 1

10
+50

MongoDB's encrypted storage engine supports two key management options:

  • Key Manager : Integration with third party key management appliance via the Key Management Interoperability Protocol (KMIP).
  • Local Key: Use of local key management via a keyfile.

Worth mentioning that using a key manager meets regulatory key management guidelines and is recommended over the local key management.

If you are using Key Manager option, please see KMIP Master Key Rotation.

Since you are using the Local Key option, if you have a Replica Set deployment you could rotate the replica set member. This would re-sync data from the un-encrypted to the encrypted mongod.

Alternatively if you only have a standalone mongod, you could:

  1. Back Up your database files.
  2. Stop mongod process.
  3. Delete or move existing database files in dbpath. Exercise extra caution! - If you are deleting, make sure you have a backup data.
  4. Restart mongod with --enableEncryption and --encryptionKeyFile.
  5. Restore backup files to the restarted and encrypted mongod.

As an example, you could use mongodump to dump the data, and use mongorestore to restore the dump files.

Lastly, note that MongoDB Enterprise edition is a commercially supported product. I'd suggest opening a support case if you have a Commercial Support subscription.

7
  • 2
    thank you for your step by step guide. I emptied the data directory, regenerated the local key and started the MongoDB instance. Now its working like a charm.
    – Gurkha
    Commented Apr 11, 2016 at 13:00
  • I am getting this error: Error parsing command line: unrecognised option '--enableEncryption'
    – null1941
    Commented Aug 27, 2016 at 13:17
  • 5
    @null1941 The answer above is for MongoDB Enterprise (v3.2+) feature which supports --enableEncryption.
    – Wan B.
    Commented Aug 28, 2016 at 23:57
  • @wan Bachtiar, can you tell me how to use the --enableEncryption option in a yaml file? :)
    – Homer Tw
    Commented Jun 16, 2020 at 10:02
  • @HomerTw docs.mongodb.com/manual/reference/configuration-options/…
    – Wan B.
    Commented Jun 20, 2020 at 2:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.