Skip to content

Commit 3b3b302

Browse files
kay-kimkay-kim
committed
tweaks to mongotools ssl support and remove ssl from mongosniff
1 parent e9166b8 commit 3b3b302

17 files changed

+338
-175
lines changed

‎source/includes/manpage-mongod-mongos-specific-options-ssl.rst‎

Lines changed: 0 additions & 104 deletions
This file was deleted.

‎source/includes/manpage-options-ssl-mongo-shell.rst‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
.. include:: /includes/replace-pem-path-name.rst
2+
3+
.. option:: --ssl
4+
5+
.. versionadded:: 2.2
6+
7+
.. include:: /includes/note-general-ssl-support.rst
8+
9+
Enable connection to a :program:`mongod` or
10+
:program:`mongos` that has SSL support enabled.
11+
12+
.. option:: --sslPEMKeyFile <filename>
13+
14+
.. versionadded:: 2.4
15+
16+
.. include:: /includes/note-general-ssl-support.rst
17+
18+
Specifies the :file:`.pem` file that contains both the SSL
19+
certificate and key. |pem-path-name|
20+
21+
Required when using the :option:`--ssl` option to connect to
22+
:program:`mongod` or :program:`mongos` that have
23+
:setting:`sslCAFile` enabled *without*
24+
:setting:`sslWeakCertificateValidation`.
25+
26+
.. option:: --sslPEMKeyPassword <value>
27+
28+
.. versionadded:: 2.4
29+
30+
.. include:: /includes/note-general-ssl-support.rst
31+
32+
Specifies the password to de-crypt the certificate-key file
33+
(i.e. :option:`--sslPEMKeyFile`). Only use
34+
:option:`--sslPEMKeyPassword` if the certificate-key file is
35+
encrypted. In all cases, |binary-name| will redact the password from
36+
all logging and reporting output.
37+
38+
.. versionchanged:: 2.6
39+
If the private key in the PEM file is encrypted and you do not
40+
specify :option:`--sslPEMKeyPassword`, |binary-name| will prompt
41+
for a passphrase. See :ref:`ssl-certificate-password`.
42+
43+
.. option:: --sslCAFile <filename>
44+
45+
.. versionadded:: 2.4
46+
47+
.. include:: /includes/note-general-ssl-support.rst
48+
49+
Specifies the :file:`.pem` file that contains the root certificate
50+
chain from the Certificate Authority. |pem-path-name|
51+
52+
.. option:: --sslCRLFile <filename>
53+
54+
.. versionadded:: 2.4
55+
56+
.. include:: /includes/note-general-ssl-support.rst
57+
58+
Specifies the :file:`.pem` file that contains the Certificate
59+
Revocation List. |pem-path-name|
60+
61+
.. option:: --sslFIPSMode
62+
63+
.. versionadded:: 2.4
64+
65+
.. include:: /includes/note-general-ssl-support.rst
66+
67+
When specified, |binary-name| will use the FIPS mode of the
68+
installed OpenSSL library. Your system must have a FIPS compliant
69+
OpenSSL library to use :option:`--sslFIPSMode`.
70+
71+
.. option:: --sslAllowInvalidCertificates
72+
73+
.. versionadded:: 2.5.4
74+
75+
.. include:: /includes/note-general-ssl-support.rst
76+
77+
Bypasses the validation checks for server certificates and allows
78+
the use of invalid certificates. When using the
79+
:setting:`sslAllowInvalidCertificates` setting, MongoDB logs as a
80+
warning the use of the invalid certificate.

‎source/includes/manpage-options-ssl-tools.rst‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
.. COMMENT because the common settings are not quite commong
2+
-- different versions added,
3+
-- invalid certificate check differ for mongod/mongos vs mongo,
4+
-- description differ for sslPEMKeyFile
5+
using separate rsts for mongod/s, mongo, tools
6+
7+
.. COMMENT this tools include file, unlike mongod/mongos/mongo
8+
uses the replacement holder of |tool-binary| to take
9+
advantage of the replace statement already in place in the
10+
individual program's file.
11+
12+
.. include:: /includes/replace-pem-path-name.rst
13+
14+
.. option:: --ssl
15+
16+
.. versionadded:: 2.5.4
17+
18+
.. include:: /includes/note-general-ssl-support.rst
19+
20+
Enable connection to a :program:`mongod` or
21+
:program:`mongos` that has SSL support enabled.
22+
23+
.. option:: --sslPEMKeyFile <filename>
24+
25+
.. versionadded:: 2.5.4
26+
27+
.. include:: /includes/note-general-ssl-support.rst
28+
29+
Specifies the :file:`.pem` file that contains both the SSL
30+
certificate and key. |pem-path-name|
31+
32+
Required when using the :option:`--ssl` option to connect to
33+
:program:`mongod` or :program:`mongos` that have
34+
:setting:`sslCAFile` enabled *without*
35+
:setting:`sslWeakCertificateValidation`.
36+
37+
.. option:: --sslPEMKeyPassword <value>
38+
39+
.. versionadded:: 2.5.4
40+
41+
.. include:: /includes/note-general-ssl-support.rst
42+
43+
Specifies the password to de-crypt the certificate-key file
44+
(i.e. :option:`--sslPEMKeyFile`). Only use
45+
:option:`--sslPEMKeyPassword` if the certificate-key file is
46+
encrypted. In all cases, |tool-binary| will redact the password from
47+
all logging and reporting output.
48+
49+
If the private key in the PEM file is encrypted and you do not
50+
specify :option:`--sslPEMKeyPassword`, |tool-binary| will prompt for
51+
a passphrase. See :ref:`ssl-certificate-password`.
52+
53+
.. option:: --sslCAFile <filename>
54+
55+
.. versionadded:: 2.5.4
56+
57+
.. include:: /includes/note-general-ssl-support.rst
58+
59+
Specifies the :file:`.pem` file that contains the root certificate
60+
chain from the Certificate Authority. |pem-path-name|
61+
62+
.. option:: --sslCRLFile <filename>
63+
64+
.. versionadded:: 2.5.4
65+
66+
.. include:: /includes/note-general-ssl-support.rst
67+
68+
Specifies the :file:`.pem` file that contains the Certificate
69+
Revocation List. |pem-path-name|
70+
71+
.. option:: --sslFIPSMode
72+
73+
.. versionadded:: 2.5.4
74+
75+
.. include:: /includes/note-general-ssl-support.rst
76+
77+
When specified, |binary-name| will use the FIPS mode of the
78+
installed OpenSSL library. Your system must have a FIPS compliant
79+
OpenSSL library to use :option:`--sslFIPSMode`.
80+
81+
.. option:: --sslAllowInvalidCertificates
82+
83+
.. versionadded:: 2.5.4
84+
85+
.. include:: /includes/note-general-ssl-support.rst
86+
87+
Bypasses the validation checks for server certificates and allows
88+
the use of invalid certificates. When using the
89+
:setting:`sslAllowInvalidCertificates` setting, MongoDB logs as a
90+
warning the use of the invalid certificate.

0 commit comments

Comments
 (0)