MongoDB X.509 Authentication Depends on Exact Subject Mapping

MongoDB deployments commonly use TLS for transport encryption and X.509 certificates for client authentication. The certificate proves possession of a private key, but MongoDB still has to map that certificate to a database user. The mapping is based on the certificate subject. Small differences in distinguished-name encoding can turn a valid certificate into an authentication failure or, worse, create an unintended identity match if administrative shortcuts are used.

How the identity is formed

MongoDB documentation says the subject field of a client certificate is mapped to a user in the $external database. The username must match the certificate subject according to the server's expected representation. The server also checks that the certificate was issued by a trusted CA and that the connection uses TLS with certificate validation.

Server and cluster member certificates are not interchangeable with client certificates.…