By default, MongoDB can accept connections without encryption or authentication. For production environments, we strongly recommend enabling both TLS and authentication to secure communication between FotoWeb and MongoDB.

Configuration is required on both the server and the client. The server defines the security requirements (authentication and TLS), while the client must match them in its connection settings.

Otherwise, we recommend running MongoDB on a server with a DNS name and a valid certificate. To use TLS, see the MongoDB documentation on how to configure the MongoDB server to use TLS with your certificate, and use the tls=true option in the connection string. For more information, see Connection string options. 

If you want to use an Enterprise CA or a self-signed certificate, see the MongoDB documentation. For example, you can use the tlsCAFile connection string option to specify the location of a local file that contains the root certificate chain from the Certificate Authority. 

Prerequisites

Before you begin, make sure that:

• You have configured Index Manager to write data to MongoDB. You must be using Index Manager version 8.1.1072 or later.
• If you are using Feature Release 19 or earlier, you need to migrate MongoDB,
• You have administrative access to your MongoDB instance.
   

Configuration requirements

Server (MongoDB)
In the MongoDB configuration file used by the MongoDB service, you must configure:

• Authentication to be required 
• Authentication credentials and authorization (users and their permissions)
• TLS to be required
• A certificate key file (PEM file containing the private key and certificate)
• A CA file, or configure MongoDB to use the system CA store

Client (FotoWeb and Index Manager)
In the MongoDB connection string, you must configure:

• TLS usage
• Credentials (username and password)

Configuring MongoDB

MongoDB must be configured to require authentication (SCRAM) and use TLS for all client connections.

These steps are performed on the MongoDB side. The exact configuration depends on how your MongoDB deployment is hosted.

We recommend following the MongoDB official documentation:

Use SCRAM to Authenticate Clients on Self-Managed Deployments 

Configure TLS/SSL for MongoDB 

Creating a MongoDB user for FotoWeb

Create a dedicated user account for FotoWeb to connect to MongoDB.

Example:

Once authentication and TLS are enabled, MongoDB will only accept encrypted and authenticated connections.

Configuring FotoWeb to use TLS and Authentication

All FotoWeb configuration must be done using the FotoWeb Settings application.
Do not edit configuration files manually.

1. Open the FotoWeb Settings app.
2. Go to Settings > Database to enter the MongoDB settings.
3. Enter the following:

• Hostname: Your MongoDB server address
• Port: Typically 27017 (unless configured differently)
• Username: The MongoDB user you created (for example fotoweb)
• Password: The user’s password

4. Enable the Use TLS (or equivalent) option.
5. Save the configuration.
6. Restart FotoWeb.

FotoWeb will automatically build a secure MongoDB connection using these values. 

Verification

After restarting FotoWeb, FotoWeb should start without MongoDB connection errors, and the MongoDB logs should show:

• Authenticated connections
• TLS-secured sessions

If FotoWeb cannot connect:

• Verify the username and password
• Confirm TLS is enabled on MongoDB
• Check that the MongoDB certificate is trusted by the system running FotoWeb