Skip to content

Commit 33f3661

Browse files
kennethdyerkennethdyer
authored
DOCSP-28412 Removes Stale SSL Content (#2730) (#2790)
* DOCSP-28412 Removes Stale SSL Content (#2730) * DOCSP-28412 Removes stale SSL options from tutorial * Removes sections * Fixes build errors * Fixes build errors * Fixes build errors * Fixes build errors * Fixes per Dave * Heading fix * Fixes per Dave * Fixes build issues
1 parent b1f32ab commit 33f3661

File tree

2 files changed

+15
-194
lines changed

2 files changed

+15
-194
lines changed

‎source/tutorial/configure-ssl-clients.txt‎

Lines changed: 9 additions & 190 deletions
Original file line numberDiff line numberDiff line change
@@ -31,19 +31,8 @@ Clients must have support for TLS/SSL to connect to a
3131

3232
.. _mongo-shell-tls-connect:
3333

34-
``mongo`` Shell Configuration (Using ``tls`` Options)
35-
-------------------------------------------------------
36-
37-
.. note::
38-
39-
Starting in version 4.2, MongoDB provides ``tls`` options that
40-
corresponds to the ``ssl`` options. The ``tls`` options provide
41-
**identical** functionality as the ``ssl`` options since MongoDB has
42-
always supported TLS 1.0 and later.
43-
44-
The procedures in this section use the ``tls`` options. For
45-
procedures using their ``ssl`` aliases, see
46-
:ref:`mongo-shell-ssl-connect`.
34+
MongoDB Shell
35+
-------------
4736

4837
The :binary:`~bin.mongo` shell provides various TLS/SSL settings,
4938
including:
@@ -111,14 +100,8 @@ certificate presented by the :binary:`~bin.mongod` or
111100

112101
.. _tls-client-connection-only:
113102

114-
Connect to MongoDB Instance Using Encryption (``tls`` Options)
115-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
116-
117-
.. note::
118-
119-
The procedure uses the ``tls`` options (available starting in
120-
MongoDB 4.2). For procedures using their ``ssl`` aliases, see
121-
:ref:`mongo-shell-ssl-connect`.
103+
Connect to MongoDB Instances Using Encryption
104+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
122105

123106
To connect to a :binary:`~bin.mongod` or :binary:`~bin.mongos` instance
124107
that requires :ref:`encrypted communication <ssl-mongod-ssl-cert-key>`,
@@ -149,14 +132,8 @@ the CA file.
149132

150133
.. _mongo-connect-require-client-certificates-tls:
151134

152-
Connect to MongoDB Instance that Requires Client Certificates (``tls`` Options)
153-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
154-
155-
.. note::
156-
157-
The procedure uses the ``tls`` options (available starting in
158-
MongoDB 4.2). For procedures using their ``ssl`` aliases, see
159-
:ref:`mongo-shell-ssl-connect`.
135+
Connect to MongoDB Instances that Require Client Certificates
136+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
160137

161138
To connect to a :binary:`~bin.mongod` or :binary:`~bin.mongos` that
162139
requires :ref:`CA-signed client certificates
@@ -237,164 +214,6 @@ Avoid Use of ``--tlsAllowInvalidCertificates`` Option
237214
hostname in the TLS/SSL certificates, see
238215
:option:`--tlsAllowInvalidHostnames <mongo --tlsAllowInvalidHostnames>`.
239216

240-
.. _mongo-shell-ssl-connect:
241-
242-
``mongo`` Shell Configuration (Using ``ssl`` Options)
243-
------------------------------------------------------
244-
245-
The :binary:`~bin.mongo` shell provides various TLS/SSL settings,
246-
including:
247-
248-
.. list-table::
249-
:header-rows: 1
250-
:widths: 30 70
251-
252-
* - SSL Option (Deprecated in 4.2)
253-
- Notes
254-
255-
* - :option:`--ssl <mongo --ssl>`
256-
- Enables TLS/SSL connection.
257-
258-
* - :option:`--sslPEMKeyFile <mongo --sslPEMKeyFile>`
259-
260-
- Specifies the :file:`.pem` file that contains the
261-
:binary:`~bin.mongo` shell's certificate and key to present to
262-
the :binary:`~bin.mongod` or :binary:`~bin.mongos` instance.
263-
264-
* - :option:`--sslPEMKeyPassword <mongo --sslPEMKeyPassword>`
265-
266-
- If the :binary:`~bin.mongo` shell's certificate key file is encrypted.
267-
268-
* - :option:`--sslCAFile <mongo --sslCAFile>`
269-
270-
- Specifies the Certificate Authority (CA) :file:`.pem` file for
271-
verification of the certificate presented by the
272-
:binary:`~bin.mongod` or the :binary:`~bin.mongos` instance.
273-
274-
* - :option:`--sslCertificateSelector <mongo --sslCertificateSelector>`
275-
276-
- If running on Windows or macOS, use a certificate from the
277-
system certificate store. (*New in version 4.0*)
278-
279-
For a complete list of the :binary:`~bin.mongo` shell's ``ssl``
280-
options, see :ref:`SSL Options <mongo-shell-ssl>`.
281-
282-
For TLS/SSL connections, the :binary:`~bin.mongo` shell validates the
283-
certificate presented by the :binary:`~bin.mongod` or
284-
:binary:`~bin.mongos` instance:
285-
286-
- The :binary:`~bin.mongo` shell verifies that the certificate is from
287-
the specified Certificate Authority :option:`--sslCAFile <mongo
288-
--sslCAFile>`. If the certificate is not from the specified CA, the
289-
:binary:`~bin.mongo` shell will fail to connect.
290-
291-
- .. include:: /includes/extracts/ssl-facts-mongo-ssl-hostname-verification.rst
292-
293-
To connect a :binary:`~bin.mongo` shell to a :binary:`~bin.mongod` or
294-
:binary:`~bin.mongos` that requires TLS/SSL, specify the
295-
:option:`--host <mongo --host>` option or use a :doc:`connection
296-
string </reference/connection-string>` to specify the hostname. All
297-
other ``TLS/SSL`` options must be specified using the command-line
298-
options.
299-
300-
.. _ssl-client-connection-only:
301-
302-
Connect to MongoDB Instance Using Encryption (``--ssl`` Options)
303-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
304-
305-
.. note::
306-
307-
The procedure uses the ``ssl`` options. For procedures using the
308-
``tls`` aliases (available starting in MongoDB 4.2), see
309-
:ref:`mongo-shell-tls-connect`.
310-
311-
To connect to a :binary:`~bin.mongod` or :binary:`~bin.mongos` instance
312-
that requires :ref:`encrypted communication <ssl-mongod-ssl-cert-key>`,
313-
start the :binary:`~bin.mongo` shell with:
314-
315-
- :option:`--ssl <mongo --ssl>`
316-
317-
- :option:`--host <mongo --host>` and :option:`--sslCAFile <mongo
318-
--sslCAFile>` to validate the server certificate.
319-
320-
For example, consider a :binary:`~bin.mongod` instance running on
321-
``hostname.example.com`` with the following options:
322-
323-
.. code-block:: bash
324-
325-
mongod --sslMode requireSSL --sslPEMKeyFile <pem>
326-
327-
To connect to the instance, start a :binary:`~bin.mongo` shell with the
328-
following options:
329-
330-
.. code-block:: bash
331-
332-
mongo --ssl --host hostname.example.com --sslCAFile /etc/ssl/caToValidateServerCertificates.pem
333-
334-
The :binary:`~bin.mongo` shell verifies the certificate presented by
335-
the :binary:`~bin.mongod` instance against the specified hostname
336-
and the CA file.
337-
338-
.. _mongo-connect-require-client-certificates-ssl:
339-
340-
Connect to MongoDB Instance that Requires Client Certificates (``ssl`` Options)
341-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
342-
343-
.. note::
344-
345-
The procedure uses the ``ssl`` options. For procedures using the
346-
``tls`` aliases (available starting in MongoDB 4.2), see
347-
:ref:`mongo-shell-tls-connect`.
348-
349-
To connect to a :binary:`~bin.mongod` or :binary:`~bin.mongos` that
350-
requires :ref:`CA-signed client certificates
351-
<ssl-mongod-ca-signed-ssl-cert-key>`, start the :binary:`~bin.mongo`
352-
shell with:
353-
354-
- :option:`--ssl <mongo --ssl>`
355-
356-
- :option:`--host <mongo --host>` and the :option:`--sslCAFile <mongo
357-
--sslCAFile>` to validate the server certificate,
358-
359-
- :option:`--sslPEMKeyFile <mongo --sslPEMKeyFile>` option to specify
360-
the client certificate to present to the server.
361-
362-
For example, consider a :binary:`~bin.mongod` instance running on
363-
``hostname.example.com`` with the following options:
364-
365-
.. code-block:: bash
366-
367-
mongod --sslMode requireSSL --sslPEMKeyFile /etc/ssl/mongodb.pem --sslCAFile /etc/ssl/ca.pem
368-
369-
To connect to the instance, start a :binary:`~bin.mongo` shell with the
370-
following options:
371-
372-
.. code-block:: bash
373-
374-
mongo --ssl --host hostname.example.com --sslPEMKeyFile /etc/ssl/client.pem --sslCAFile /etc/ssl/ca.pem
375-
376-
On Windows and macOS
377-
````````````````````
378-
379-
You can also use the ``--sslCertificateSelector`` option to specify the
380-
client certificate from the system certificate store instead of using
381-
``--sslPEMKeyFile``. If the CA file is also in the system certificate
382-
store, you can omit the ``--sslCAFile`` option.
383-
384-
For example, to use a certificate with the ``CN`` (Common Name) of
385-
``myclient.example.net`` and the CA file from the system certificate
386-
store on macOS, start :binary:`~bin.mongo` with the following
387-
options:
388-
389-
.. code-block:: bash
390-
391-
mongo --ssl --host hostname.example.com --sslCertificateSelector subject=myclient.example.net
392-
393-
Avoid Use of ``--sslAllowInvalidCertificates`` Option
394-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
395-
396-
.. include:: /includes/extracts/ssl-facts-invalid-cert-warning-clients.rst
397-
398217
|atlas|, |MMS| and MongoDB Ops Manager
399218
--------------------------------------
400219

@@ -447,9 +266,9 @@ tools include:
447266
- :binary:`~bin.mongostat`
448267
- :binary:`~bin.mongotop`
449268

450-
To use encrypted communication with these tools, use the same ``ssl`` options as
451-
the :binary:`~bin.mongo` shell. See :ref:`mongo-shell-ssl-connect`.
269+
To use encrypted communication with these tools, use the same ``tls`` options as
270+
:binary:`~bin.mongo`. See :ref:`mongo-shell-tls-connect`.
452271

453272
.. seealso::
454273

455-
:doc:`/tutorial/configure-ssl`
274+
:ref:`configure-mongod-mongos-for-tls-ssl`

‎source/tutorial/configure-ssl.txt‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
.. _configure-mongod-mongos-for-tls-ssl:
2+
13
===============================================
24
Configure ``mongod`` and ``mongos`` for TLS/SSL
35
===============================================
@@ -733,7 +735,7 @@ can only use TLS/SSL connections:
733735
mongod --config <path/to/configuration/file>
734736

735737
That is, clients must specify TLS/SSL connections. See
736-
:ref:`ssl-client-connection-only` for more information on
738+
:ref:`tls-client-connection-only` for more information on
737739
connecting with TLS/SSL.
738740

739741
.. seealso::
@@ -846,9 +848,9 @@ its clients:
846848

847849
mongod --config <path/to/configuration/file>
848850

849-
That is, clients must specify TLS/SSL connections and presents its
851+
That is, clients must specify TLS/SSL connections and present their
850852
certificate key file to the instance. See
851-
:ref:`mongo-connect-require-client-certificates-ssl` for more
853+
:ref:`mongo-connect-require-client-certificates-tls` for more
852854
information on connecting with TLS/SSL.
853855

854856
.. seealso::
@@ -900,7 +902,7 @@ To prevent clients with revoked certificates from connecting to the
900902
CAFile: /etc/ssl/caToValidateClientCertificates.pem
901903
CRLFile: /etc/ssl/revokedCertificates.pem
902904

903-
Clients who presents certificates that are listed in the
905+
Clients who present certificates that are listed in the
904906
:file:`/etc/ssl/revokedCertificates.pem` will not be able to connect.
905907

906908
.. seealso::

0 commit comments

Comments
 (0)