(DOCSP-12907): add tls options to cluster config file (#337)

* (DOCSP-12907): add tls options to cluster config file

* (DOCSP-12907): fix header rows

* (DOCSP-12907): tech review feedback

* (DOCSP-12907): fix casing

* (DOCSP-12907): reorder fields

Author: jwilliams-mongo

source/reference/mms-cluster-settings-file.txt

@@ -173,6 +173,222 @@ replica set member:
        and cannot trigger elections. 
      - yes
 
+   * - ``tls.CAFile``
+     - string
+     - ``.pem`` file that contains the root certificate chain from the 
+       Certificate Authority. Specify the file name of the ``.pem`` file
+       using relative or absolute paths.
+
+       This setting corresponds to the :manual:`net.tls.CAFile
+       </reference/configuration-options/#net.tls.CAFile>` |mongod|
+       replica set configuration option.
+     - no
+
+   * - ``tls.certificateKeyFile``
+     - string
+     - ``.pem`` file that contains both the TLS certificate and key.
+
+       ``tls.certificateKeyFile`` and ``tls.certificateSelector`` are
+       mutually exclusive. You can only specify one.
+
+       This setting corresponds to the :manual:`net.tls.certificateKeyFile
+       </reference/configuration-options/#net.tls.certificateKeyFile>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.certificateKeyFilePassword``
+     - string
+     - Password to de-crypt the certificate-key file.
+
+       Use the ``tls.certificateKeyFilePassword`` option only if the
+       certificate-key file is encrypted. In all cases, the |mongos| or
+       |mongod| will redact the password from all logging and reporting
+       output.
+
+       This setting corresponds to the
+       :manual:`net.tls.certificateKeyFilePassword 
+       </reference/configuration-options/#net.tls.certificateKeyFilePassword>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.certificateSelector``
+     - string
+     - Certificate property that the {+mdbagent+} uses to select a
+       matching certificate from the operating system’s certificate
+       store to use for TLS/SSL.
+
+       {+mcli+} accepts one of the following key-value mappings as an
+       argument of ``tls.certificateSelector``:
+
+       .. list-table::
+          :header-rows: 1
+       
+          * - Key
+            - Value type
+            - Description
+          * - ``subject``
+            - ASCII string	
+            - The subject name or common name on the certificate.
+          * - ``thumbprint``
+            - hex string
+            - A sequence of bytes, expressed as hexadecimal, used to
+              identify a public key by its SHA-1 digest.
+
+              The ``thumbprint`` is sometimes referred to as a
+              ``fingerprint``.
+
+       ``tls.certificateKeyFile`` and ``tls.certificateSelector`` are
+       mutually exclusive. You can only specify one.
+
+       This setting corresponds to the
+       :manual:`net.tls.certificateSelector 
+       </reference/configuration-options/#net.tls.certificateSelector>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.clusterCertificateSelector``
+     - string
+     - Certificate property that the {+mdbagent+} uses to select a
+       matching certificate from the operating system’s certificate
+       store to use for :manual:`internal x.509 membership
+       authentication
+       </core/security-internal-authentication/#internal-auth-x509>`. 
+
+       {+mcli+} accepts one of the following key-value mappings as an
+       argument of ``tls.clusterCertificateSelector``:
+
+       .. list-table::
+          :header-rows: 1
+       
+          * - Key
+            - Value type
+            - Description
+          * - ``subject``
+            - ASCII string	
+            - The subject name or common name on the certificate.
+          * - ``thumbprint``
+            - hex string
+            - A sequence of bytes, expressed as hexadecimal, used to
+              identify a public key by its SHA-1 digest.
+
+              The ``thumbprint`` is sometimes referred to as a
+              ``fingerprint``.
+
+       ``tls.clusterCertificateSelector`` and ``tls.clusterFile`` are
+       mutually exclusive. You can only specify one.
+
+       This setting corresponds to the
+       :manual:`net.tls.clustercertificateSelector 
+       </reference/configuration-options/#net.tls.clustercertificateSelector>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.clusterFile``
+     - string
+     - ``.pem`` file that contains the x.509 certificate-key file for
+       :manual:`membership authentication
+       </tutorial/configure-x509-member-authentication/#x509-internal-authentication>`
+       for the cluster or replica set.
+
+       ``tls.clusterCertificateSelector`` and ``tls.clusterFile`` are
+       mutually exclusive. You can only specify one.
+
+       This setting corresponds to the :manual:`net.tls.clusterFile
+       </reference/configuration-options/#net.tls.clusterFile>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.clusterPassword``
+     - string
+     - The password to de-crypt the x.509 certificate-key file specified
+       with ``tls.clusterFile``.
+
+       Use the ``tls.clusterPassword`` option only if the certificate-key
+       file is encrypted. In all cases, the |mongos| or |mongod| will
+       redact the password from all logging and reporting output.
+
+       This setting corresponds to the :manual:`net.tls.clusterPassword
+       </reference/configuration-options/#net.tls.clusterPassword>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.CRLFile``
+     - string
+     - The ``.pem`` file that contains the Certificate Revocation List.
+       Specify the file name of the ``.pem`` file using relative or
+       absolute paths.
+
+       This setting corresponds to the :manual:`net.tls.CRLFile
+       </reference/configuration-options/#net.tls.CRLFile>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.disabledProtocols``
+     - string
+     - Protocols or versions over which a MongoDB server running with
+       TLS refuses incoming connections.
+
+       This setting corresponds to the :manual:`net.tls.disabledProtocols
+       </reference/configuration-options/#net.tls.disabledProtocols>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.FIPSMode``
+     - string
+     - Enable or disable the use of the FIPS mode of the TLS library for
+       the |mongos| or |mongod|. Your system must have a FIPS compliant
+       library to use this option.
+
+       This setting corresponds to the :manual:`net.tls.FIPSMode
+       </reference/configuration-options/#net.tls.FIPSMode>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.mode``
+     - string
+     - Enables TLS for all network connections. {+mcli+} accepts the
+       following arguments for this setting:
+
+       .. list-table::
+          :header-rows: 1
+          :widths: 20 40
+        
+          * - Value
+            - Description
+        
+          * - ``disabled``
+            - The server does not use tls.
+        
+          * - ``allowTLS``
+            - Connections between servers do not use tls. For incoming
+              connections, the server accepts both TLS and non-tls.
+
+          * - ``preferTLS``
+            - Connections between servers use tls. For incoming
+              connections, the server accepts both TLS and non-tls.
+
+          * - ``requireTLS``
+            - The server uses and accepts only TLS encrypted connections.
+
+       This setting corresponds to the :manual:`net.tls.mode
+       </reference/configuration-options/#net.tls.mode>`
+       |mongod| replica set configuration option.
+     - no
+
+   * - ``tls.PEMKeyFile``
+     - string
+     - ``.pem`` file that contains both the TLS certificate and key.
+
+       .. important::
+
+          This setting is deprecated. Use ``tls.certificateKeyFile``
+          instead.
+
+       This setting corresponds to the :manual:`net.ssl.PEMKeyFile
+       </reference/configuration-options/#net.ssl.PEMKeyFile>`
+       |mongod| replica set configuration option.
+     - no
+
    * - ``votes``
      - integer
      - Number that indicates whether the replica set member