Skip to content

DOCS-11691: cursor.min/cursor.max (v3.2.21) #3339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 7, 2018
Merged

DOCS-11691: cursor.min/cursor.max (v3.2.21) #3339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
38eb356
DOCS-11691: cursor.min/cursor.max (v3.2.21)
kay-kim Jun 12, 2018
0e7f3aa
DOCS-11689: x509 and invalid Certificates
kay-kim Jun 20, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 0 additions & 31 deletions source/includes/extracts-mongo-ssl-options-base.yaml
View file
Open in desktop

This file was deleted.

37 changes: 0 additions & 37 deletions source/includes/extracts-mongo-ssl-options.yaml
View file
Open in desktop

This file was deleted.

68 changes: 68 additions & 0 deletions source/includes/extracts-ssl-facts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
ref: ssl-facts-x509-invalid-certificate
content: |

Starting in MongoDB 3.2.21, if you specify
``--sslAllowInvalidCertificates`` or ``ssl.allowInvalidCertificates:
true`` when using x.509 authentication, an invalid certificate is
only sufficient to establish a TLS/SSL connection but is
*insufficient* for authentication.
---
ref: ssl-facts-x509-ca-file
content: |

If using x.509 authentication, ``--sslCAFile`` or ``ssl.CAFile``
must be specified.
---
ref: ssl-facts-see-more
content: |
For more information about TLS/SSL and MongoDB, see
:doc:`/tutorial/configure-ssl` and
:doc:`/tutorial/configure-ssl-clients` .
---
# This is separate from the mongod/mongos ca file extract since the version is different.
ref: ssl-facts-mongo-shell-ca
content: |

Starting in version 3.2.6, if ``--sslCAFile`` or ``ssl.CAFile`` is
not specified, the system-wide CA certificate store will be used
when connecting to an TLS/SSL-enabled server. In previous versions
of MongoDB, the :binary:`~bin.mongo` shell exited with an error that
it could not validate the certificate.

.. include:: /includes/extracts/ssl-facts-x509-ca-file.rst
---
ref: ssl-facts-invalid-cert-warning-clients
content: |

.. warning::

For TLS/SSL connections to :binary:`~bin.mongod` and
:binary:`~bin.mongos`, avoid using
``--sslAllowInvalidCertificates`` if possible and only use
``--sslAllowInvalidCertificates`` on systems where intrusion is
not possible.

If the :binary:`~bin.mongo` shell (and other
:ref:`mongodb-tools-support-ssl`) runs with the
``--sslAllowInvalidCertificates`` option, the
:binary:`~bin.mongo` shell (and other
:ref:`mongodb-tools-support-ssl`) will not attempt to validate
the server certificates. This creates a vulnerability to expired
:binary:`~bin.mongod` and :binary:`~bin.mongos` certificates as
well as to foreign processes posing as valid
:binary:`~bin.mongod` or :binary:`~bin.mongos` instances.

---
ref: ssl-facts-mongo-ssl-options-configure
content: |

To connect to a :binary:`~bin.mongod` or :binary:`~bin.mongos` that
uses TLS/SSL, you must also specify the ``--host`` option for the
:binary:`~bin.mongo` shell if you haven't specified a connect
string. The :binary:`~bin.mongo` shell verifies that the hostname of
the :binary:`~bin.mongod` or :binary:`~bin.mongos` matches the CN or
SAN of ``--sslPEMKeyFile`` certificate presented by the
:binary:`~bin.mongod` or :binary:`~bin.mongos`. If the hostname does
not match the CN/SAN, :binary:`~bin.mongo` will fail to connect.

...
6 changes: 0 additions & 6 deletions source/includes/fact-ssl-supported.rst
View file
Open in desktop

This file was deleted.

3 changes: 2 additions & 1 deletion source/includes/options-conf.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -686,6 +686,7 @@ directive: setting
replacement:
program: ":binary:`~bin.mongos` or :binary:`~bin.mongod`"
verb: "Enable or disable"
setting: "``allowInvalidCertificates: true``"
inherit:
name: sslAllowInvalidCertificates
program: mongod
Expand Down Expand Up @@ -1568,7 +1569,7 @@ description: |
MongoDB instances if the hostname their certificates do not match the
specified hostname.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst

replacement:
program: ":binary:`~bin.mongod`"
Expand Down
33 changes: 18 additions & 15 deletions source/includes/options-mongo.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,12 +213,14 @@ args: null
directive: option
description: |

.. versionchanged:: 3.2.6

Enables connection to a :binary:`~bin.mongod` or :binary:`~bin.mongos` that has
TLS/SSL support enabled.

.. include:: /includes/extracts/mongo-ssl-options-mongo.rst
.. include:: /includes/extracts/ssl-facts-mongo-shell-ca.rst

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
---
program: mongo
Expand All @@ -236,7 +238,7 @@ description: |
:setting:`~net.ssl.CAFile` enabled *without*
:setting:`~net.ssl.allowConnectionsWithoutCertificates`.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
---
program: mongo
Expand All @@ -254,7 +256,7 @@ description: |
specify the {{role}} option, the {{program}} will prompt for a
passphrase. See :ref:`ssl-certificate-password`.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
---
program: mongo
Expand All @@ -266,11 +268,9 @@ description: |
from the Certificate Authority. Specify the file name of the
:file:`.pem` file using relative or absolute paths.

.. include:: /includes/extracts/mongo-ssl-options-mongo.rst

.. include:: /includes/extracts/mongo-warning-sslCAFile.rst
.. include:: /includes/extracts/ssl-facts-mongo-shell-ca.rst

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst

optional: true
---
Expand All @@ -284,7 +284,7 @@ description: |
List. Specify the file name of the :file:`.pem` file using relative or
absolute paths.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
---
program: mongo
Expand All @@ -302,15 +302,18 @@ directive: option
description: |

Bypasses the validation checks for server certificates and allows
the use of invalid certificates. When using the
:setting:`~net.ssl.allowInvalidCertificates` setting, MongoDB logs as a
warning the use of the invalid certificate.
the use of invalid certificates to connect.

.. note::

.. include:: /includes/extracts/ssl-facts-x509-invalid-certificate.rst

.. include:: /includes/extracts/mongo-ssl-options-mongo.rst
.. include:: /includes/extracts/ssl-facts-invalid-cert-warning-clients.rst

.. include:: /includes/extracts/mongo-warning-sslCAFile.rst
When using the :setting:`~net.ssl.allowInvalidCertificates` setting,
MongoDB logs as a warning the use of the invalid certificate.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
---
program: mongo
Expand Down
41 changes: 26 additions & 15 deletions source/includes/options-mongod.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -598,7 +598,9 @@ description: |
- Recommended. Send the x.509 certificate for authentication and
accept only x.509 certificates.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-x509-ca-file.rst

.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
---
program: mongod
Expand Down Expand Up @@ -1183,7 +1185,7 @@ description: |
{{option}}. By default, {{role}} is
disabled.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
replacement:
verb: "Enables"
Expand Down Expand Up @@ -1226,7 +1228,9 @@ description: |

- The server uses and accepts only TLS/SSL encrypted connections.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-x509-ca-file.rst

.. include:: /includes/extracts/ssl-facts-see-more.rst

optional: true
replacement:
Expand All @@ -1244,7 +1248,7 @@ description: |

You must specify {{role}} when TLS/SSL is enabled.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
replacement:
intro: "Specifies the"
Expand All @@ -1264,7 +1268,7 @@ description: |
specify the {{role}} option, the {{program}} will prompt for a
passphrase. See :ref:`ssl-certificate-password`.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
replacement:
intro: "Specifies the"
Expand All @@ -1285,7 +1289,9 @@ description: |
authentication, the cluster uses the ``.pem`` file specified in the
{{pemKeyOption}} {{directive}}.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-x509-ca-file.rst

.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
replacement:
pemKeyOption: ":option:`--sslPEMKeyFile`"
Expand All @@ -1308,7 +1314,7 @@ description: |
{{role}} option, the {{program}} will prompt for a passphrase. See
:ref:`ssl-certificate-password`.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
replacement:
intro: "Specifies the"
Expand All @@ -1323,9 +1329,9 @@ description: |
from the Certificate Authority. Specify the file name of the
:file:`.pem` file using relative or absolute paths.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-x509-ca-file.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst

.. include:: /includes/warning-x509-requires-sslCAfile.rst
optional: true
replacement:
intro: "Specifies the"
Expand All @@ -1340,7 +1346,7 @@ description: |
List. Specify the file name of the :file:`.pem` file using relative or
absolute paths.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
replacement:
intro: "Specifies the"
Expand All @@ -1351,14 +1357,19 @@ args: null
directive: option
description: |

{{verb}} the validation checks for TLS/SSL certificates on other servers
in the cluster and allows the use of invalid certificates.
{{verb}} the validation checks for TLS/SSL certificates on other
servers in the cluster and allows the use of invalid certificates to
connect.

.. note::

.. include:: /includes/extracts/ssl-facts-x509-invalid-certificate.rst

When using
the {{role}} setting, MongoDB
logs a warning regarding the use of the invalid certificate.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
replacement:
verb: "Bypasses"
Expand All @@ -1381,7 +1392,7 @@ description: |
Use the {{role}} option if you have a mixed deployment that includes
clients that do not or cannot present certificates to the {{program}}.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
replacement:
verb: "Disables"
old_name: "``--sslWeakCertificateValidation``"
Expand All @@ -1401,7 +1412,7 @@ description: |
to other members if the hostnames in their certificates do not match
their configured hostname.

.. include:: /includes/fact-ssl-supported.rst
.. include:: /includes/extracts/ssl-facts-see-more.rst
optional: true
---
program: mongod
Expand Down
Loading