Error when enabling data encryption using local ke

Question

I have successfully encrypted the communication in mongoDB but when I try to enable the data encryption I'm getting errors. I am using the enterprise edition of mongoDB with version 3.2.4. I get the following message in the console:

ERROR: child process failed, exited with error number 14

But when I look at the logs I see detailed error as follows:

Unable to retrieve key .system, error: there are existing data files, but no valid keystore could be located.
Fatal Assertion 28561

following is the snippet of my config file:

# enable authentication
security:
  authorization: enabled
  enableEncryption: true
  encryptionKeyFile: /home/test/mongodb-keyfile

It works fine without the enableEncryption, and encryptionKeyFile parameters. Could anyone explain what i'm missing here? thanks!

Answer 1

MongoDB's encrypted storage engine supports two key management options:

• Key Manager : Integration with third party key management appliance via the Key Management Interoperability Protocol (KMIP).
• Local Key: Use of local key management via a keyfile.

Worth mentioning that using a key manager meets regulatory key management guidelines and is recommended over the local key management.

If you are using Key Manager option, please see KMIP Master Key Rotation.

Since you are using the Local Key option, if you have a Replica Set deployment you could rotate the replica set member. This would re-sync data from the un-encrypted to the encrypted mongod.

Alternatively if you only have a standalone mongod, you could:

1. Back Up your database files.
2. Stop mongod process.
3. Delete or move existing database files in dbpath. Exercise extra caution! - If you are deleting, make sure you have a backup data.
4. Restart mongod with --enableEncryption and --encryptionKeyFile.
5. Restore backup files to the restarted and encrypted mongod.

As an example, you could use mongodump to dump the data, and use mongorestore to restore the dump files.

Lastly, note that MongoDB Enterprise edition is a commercially supported product. I'd suggest opening a support case if you have a Commercial Support subscription.