# Add additional CA certificate for mutual tls (teleport auth)

**URL:** <https://forums.percona.com/t/add-additional-ca-certificate-for-mutual-tls-teleport-auth/30585>\
**Category:** Percona Operator for MongoDB\
**Created:** [May 27, 2024, 7:26am UTC](https://forums.percona.com/t/add-additional-ca-certificate-for-mutual-tls-teleport-auth/30585 "2024-05-27T07:26:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![RogerSik](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/rogersik/32/16446_2.png) [@RogerSik](https://forums.percona.com/u/RogerSik)\
**Post date:** [May 27, 2024, 7:26am UTC](https://forums.percona.com/t/add-additional-ca-certificate-for-mutual-tls-teleport-auth/30585/1 "2024-05-27T07:26:52Z")

</div>

Did someone successfully added an additionally ca cert to the mongodb cluster?

I want to add the CA certificate from teleport so that connections can be tunneled over teleport:

- [https://goteleport.com/docs/database-access/guides/mongodb-self-hosted](https://goteleport.com/docs/database-access/guides/mongodb-self-hosted)

Step 2: Configure MongoDB → Set up mutual TLS:

> Export the Teleport Database Client CA from Teleport, and then add it as an **additional trusted** CA by concatenating it with your CA’s certificate:

```auto
tctl auth export --type=db-client > db-client-ca.crt
cat /path/to/your/ca.crt db-client-ca.crt > /etc/certs/mongo.cas

```

```auto
net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/certs/mongo.crt
    CAFile: /etc/certs/mongo.cas

```

but not sure how to modify the mongodb perconca cluster to add additional CA certificate?

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [May 29, 2024, 7:31am UTC](https://forums.percona.com/t/add-additional-ca-certificate-for-mutual-tls-teleport-auth/30585/2 "2024-05-29T07:31:39Z")

</div>

@RogerSik,  
we have not tried it.

But to add additional CA you can modify \<cluster\_name\>-ssl and \<cluster\_name\>-ssl-internal secret resources.

In both secrets there will ba ca.crt file.

1. `kubectl get <cluster_name>-ssl -o yaml`
2. Copy the ca.crt base64 encoded string and decode it with `base64 --decode`
3. Add the needful CA
4. Encode the new ca.crt into base64
5. Edit the secret and put the new string there

Do the same for internal secret.

Also have a look at [Transport encryption (TLS/SSL) - Percona Operator for MongoDB](https://docs.percona.com/percona-operator-for-mongodb/TLS.html#generate-certificates-manually)

It explains how the certificates must be structured.

_Note: we have not tested two CAs, so not sure how MongoDB would behave._