@@ -10,6 +10,13 @@ Enable TLS/SSL on a Connection
10
10
:depth: 2
11
11
:class: singlecol
12
12
13
+ .. facet::
14
+ :name: genre
15
+ :values: tutorial
16
+
17
+ .. meta::
18
+ :keywords: code example, security, connection options
19
+
13
20
Overview
14
21
--------
15
22
@@ -23,7 +30,7 @@ or `MongoClientSettings <{+api+}/apidocs/mongodb-driver-core/com/mongodb/MongoCl
23
30
.. note:: Debugging TLS/SSL
24
31
25
32
If you experience trouble setting up your TLS/SSL connection, you can
26
- use the ``-Djavax.net.debug=all`` system property to view additional
33
+ use the ``-Djavax.net.debug=all`` system property to view more
27
34
log statements. See `the Oracle guide to debugging TLS/SSL connections
28
35
<https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ReadDebug.html>`__
29
36
for more information.
@@ -86,7 +93,7 @@ Configure Certificates
86
93
87
94
Java applications that initiate TLS/SSL requests require access to
88
95
cryptographic certificates that prove identity for the application
89
- itself as well as other applications with which the application
96
+ itself and other applications with which the application
90
97
interacts. You can configure access to these certificates in your application with
91
98
the following mechanisms:
92
99
@@ -121,7 +128,7 @@ application is genuine and secure from tampering by third parties.
121
128
If your MongoDB instance uses a certificate that is signed by an
122
129
authority that is not present in the JRE's default certificate store,
123
130
your application must configure two system properties to initiate
124
- SSL/TLS requests. These properties ensure that your application is able to
131
+ SSL/TLS requests. These properties ensure that your application can
125
132
validate the TLS/SSL certificate presented by a connected MongoDB instance.
126
133
127
134
- ``javax.net.ssl.trustStore``: the path to a trust store containing the
@@ -145,8 +152,8 @@ Configure the JVM Key Store
145
152
.. note::
146
153
147
154
By default, MongoDB instances do not perform client certificate
148
- validation. You only need to configure the key store if you explicitly
149
- configured your MongoDB instance to validate client certificates.
155
+ validation. You must configure the key store if you configured your MongoDB
156
+ instance to validate client certificates.
150
157
151
158
The JVM key store saves certificates that securely identify your Java
152
159
application to other applications. Using these certificates, other
@@ -165,11 +172,11 @@ the MongoDB deployment:
165
172
166
173
You can create a key store with the `keytool
167
174
<https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html>`__
168
- or `openssl <https://www.openssl.org/docs/apps/ openssl.html>`__ command
169
- line tools .
175
+ or `openssl <https://www.openssl.org/docs/manmaster/man1/ openssl.html>`__
176
+ command line tool .
170
177
171
178
For more information on configuring a Java application to use TLS/SSL,
172
- please refer to the `JSSE Reference Guide
179
+ please see the `JSSE Reference Guide
173
180
<https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html>`__.
174
181
175
182
.. _tls-disable-hostname-verification:
@@ -192,7 +199,7 @@ Disable Hostname Verification
192
199
193
200
By default, the driver ensures that the hostname included in the server's
194
201
TLS/SSL certificates matches the hostnames provided when constructing
195
- a ``MongoClient``. If you need to disable hostname verification for your
202
+ a ``MongoClient``. To disable hostname verification for your
196
203
application, you can explicitly disable this by setting the
197
204
``invalidHostNameAllowed`` property of the builder to ``true`` in the
198
205
``applytoSslSettings()`` builder lambda:
@@ -210,7 +217,7 @@ application, you can explicitly disable this by setting the
210
217
211
218
Disabling hostname verification can make your configuration
212
219
`insecure <https://tlseminar.github.io/docs/mostdangerous.pdf>`__.
213
- You should only disable hostname verification for testing purposes or
220
+ Disable hostname verification only for testing purposes or
214
221
when there is no other alternative.
215
222
216
223
.. _tls-restrict-tls-1.2:
@@ -223,17 +230,17 @@ To restrict your application to use only the TLS 1.2 protocol, set the
223
230
224
231
.. note::
225
232
226
- Java Runtime Environments (JREs) prior to Java 8 only enabled
233
+ Java Runtime Environments (JREs) before Java 8 only enabled
227
234
the TLS 1.2 protocol in update releases. If your JRE has not enabled
228
- the TLS 1.2 protocol, you may need to upgrade to a later release to
229
- connect using TLS 1.2.
235
+ the TLS 1.2 protocol, upgrade to a later release to connect by using
236
+ TLS 1.2.
230
237
231
238
.. _tls-custom-sslContext:
232
239
233
240
Customize TLS/SSL Configuration through the Java SE SSLContext
234
241
--------------------------------------------------------------
235
242
236
- If your TLS/SSL configuration requires additional customization, you can
243
+ If your TLS/SSL configuration requires customization, you can
237
244
set the ``sslContext`` property of your ``MongoClient`` by
238
245
passing an `SSLContext
239
246
<https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/SSLContext.html>`__
@@ -297,7 +304,7 @@ Online Certificate Status Protocol (OCSP)
297
304
298
305
OCSP is a standard used to check whether X.509 certificates have been
299
306
revoked. A certificate authority can add an X.509 certificate to the
300
- Certificate Revocation List (CRL) prior to the expiry time to invalidate
307
+ Certificate Revocation List (CRL) before the expiry time to invalidate
301
308
the certificate. When a client sends an X.509 certificate during the TLS
302
309
handshake, the CA's revocation server checks the CRL and returns a status
303
310
of "good", "revoked", or "unknown".
@@ -371,7 +378,7 @@ properties:
371
378
|
372
379
| If unset or set to ``false``, the connection can proceed regardless of the presence or status of the certificate revocation response.
373
380
374
- For additional information about OCSP, check out the following resources:
381
+ For more information about OCSP, check out the following resources:
375
382
376
383
- Oracle JDK 8 Documentation on `how to enable OCSP for an application <https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ocsp.html>`__
377
384
- :rfc:`Official IETF specification for OCSP (RFC 6960) <6960>`
0 commit comments