Citrix Secure Developer Spaces™

Configure external MongoDB with X.509 authentication in Citrix Secure Developer Spaces™

June 09, 2026

Contributed by:

You can configure SDS to authenticate to an external MongoDB deployment with X.509 certificates instead of username and password credentials. Use this option for deployments that require certificate-based authentication, such as MongoDB Atlas environments managed by enterprise security teams.

Prerequisites

An external MongoDB deployment that supports MONGODB-X509
A MongoDB X.509 database user whose distinguished name matches the client certificate subject
A client certificate and private key in PEM format
The certificate authority bundle if your MongoDB deployment uses a private certificate authority
Access to update the SDS Helm values and run helm upgrade

Configure X.509 authentication with inline certificate values

Base64 encode the certificate files and add them to platform.externalMongodb.auth:

platform:
  externalMongodb:
    hostName: "cluster.example.mongodb.net"
    protocol: "mongodb+srv"
    additionalParameters: "retryWrites=true&w=majority"
    authMechanism: "MONGODB-X509"
    auth:
      database: "strong-network"
      caCertPemB64: "<base64-ca-certificate>"
      certPemB64: "<base64-client-certificate>"
      certKeyPemB64: "<base64-client-private-key>"
<!--NeedCopy-->

If your MongoDB deployment uses a publicly trusted certificate authority, you can omit caCertPemB64. SDS then uses the system certificate pool.

Configure X.509 authentication with an existing Kubernetes Secret

If you already manage the certificate material in Kubernetes, reference the Secret and the key names:

platform:
  externalMongodb:
    hostName: "cluster.example.mongodb.net"
    protocol: "mongodb+srv"
    additionalParameters: "retryWrites=true&w=majority"
    authMechanism: "MONGODB-X509"
    auth:
      database: "strong-network"
      existingSecret: "sds-mongodb-x509"
      existingSecretKeys:
        caCert: "ca.pem"
        cert: "tls.crt"
        certKey: "tls.key"
<!--NeedCopy-->

The Secret must exist in the SDS deployment namespace before you apply the Helm upgrade.

Apply the configuration

Update your SDS Helm values file.
Confirm that the external MongoDB host, protocol, and additional parameters match your MongoDB deployment.
Run your standard helm upgrade command.
Confirm that SDS services start successfully and can connect to the external MongoDB deployment.

After the upgrade, SDS connects to the external MongoDB deployment by using the configured X.509 client certificate.

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

Configure external MongoDB with X.509 authentication in Citrix Secure Developer Spaces™

June 09, 2026

Contributed by:

June 09, 2026

Contributed by:

Configure external MongoDB with X.509 authentication in Citrix Secure Developer Spaces™

Prerequisites

Configure X.509 authentication with inline certificate values

Configure X.509 authentication with an existing Kubernetes Secret

Apply the configuration

In this article