Skip to content

Commit 38c037c

Browse files
committed
NODE-929 Update SSL tutorial to correctly reflect the non-need for server/mongos/replset subobjects
1 parent 7832ca9 commit 38c037c

File tree

1 file changed

+28
-61
lines changed
  • docs/reference/content/tutorials/connect

1 file changed

+28
-61
lines changed

docs/reference/content/tutorials/connect/ssl.md

Lines changed: 28 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ title = "SSL Settings"
1313
The Node.js driver supports TLS/SSL connections to MongoDB that support TLS/SSL support.
1414

1515
## No Certificate Validation
16-
1716
If the MongoDB instance does not perform any validation of the certificate chain, include the `ssl=true` in the [URI Connection String ](https://docs.mongodb.org/manual/reference/connection-string/).
1817

1918
```js
@@ -22,16 +21,14 @@ var MongoClient = require('mongodb').MongoClient;
2221
MongoClient.connect("mongodb://localhost:27017/test?ssl=true", function(err, db) {
2322
db.close();
2423
});
25-
2624
```
2725

2826
## Validate Server Certificate
29-
3027
If the MongoDB instance presents a certificate, to validate the server's certificate, pass to the `MongoClient.connect` method:
3128

3229
- A [URI Connection String ](https://docs.mongodb.org/manual/reference/connection-string/) that includes `ssl=true` setting,
3330

34-
- A connections options for the `server` with the certificate for the Certificate Authority (`sslCA`) and the `sslValidate` setting set to `true`
31+
- A connections options with the certificate for the Certificate Authority (`sslCA`) and the `sslValidate` setting set to `true`
3532

3633
```js
3734
var MongoClient = require('mongodb').MongoClient,
@@ -43,23 +40,20 @@ var ca = [fs.readFileSync(__dirname + "/ssl/ca.pem")];
4340

4441
// Connect validating the returned certificates from the server
4542
MongoClient.connect("mongodb://localhost:27017/test?ssl=true", {
46-
server: {
47-
sslValidate:true
48-
, sslCA:ca
49-
}
43+
sslValidate:true,
44+
sslCA:ca
5045
}, function(err, db) {
5146
db.close();
5247
});
5348
```
5449

5550
## Disable Hostname Verification
56-
5751
By default, the driver ensures that the hostname included in the
5852
server's SSL certificate(s) matches the hostname(s) provided in the URI connection string. If you need to disable the hostname verification, but otherwise validate the server's certificate, pass to the `MongoClient.connect` method:
5953

6054
- A [URI Connection String ](https://docs.mongodb.org/manual/reference/connection-string/) that includes `ssl=true` setting,
6155

62-
- A connections options for the `server` with the certificate for the Certificate Authority (`sslCA`) and the `sslValidate` setting set to `true` but `checkServerIdentity` set to `false`.
56+
- A connections options with the certificate for the Certificate Authority (`sslCA`) and the `sslValidate` setting set to `true` but `checkServerIdentity` set to `false`.
6357

6458
```js
6559
var MongoClient = require('mongodb').MongoClient,
@@ -71,24 +65,21 @@ var ca = [fs.readFileSync(__dirname + "/ssl/ca.pem")];
7165

7266
// Connect validating the returned certificates from the server
7367
MongoClient.connect("mongodb://localhost:27017/test?ssl=true", {
74-
server: {
75-
sslValidate:true
76-
, checkServerIdentity:false
77-
, sslCA:ca
78-
}
68+
sslValidate:true,
69+
checkServerIdentity:false,
70+
sslCA:ca
7971
}, function(err, db) {
8072
db.close();
8173
});
8274
```
8375

8476
## Validate Server Certificate and Present Valid Certificate
85-
8677
If the MongoDB server performs certificate validation, the client must pass its
8778
certificate to the server. To pass the client's certificate as well as to validate the server's certificate, pass to the `MongoClient.connect` method:
8879

8980
- A [URI Connection String ](https://docs.mongodb.org/manual/reference/connection-string/) that includes `ssl=true` setting,
9081

91-
- A connections options for the `server` with the `sslValidate` setting set to `true`, the certificate for the Certificate Authority (`sslCA`), the client's certificate (`sslCert`) and private key file (`sslKey`). If the client's key file is encrypted, include the password (`sslPass`).
82+
- A connections options with the `sslValidate` setting set to `true`, the certificate for the Certificate Authority (`sslCA`), the client's certificate (`sslCert`) and private key file (`sslKey`). If the client's key file is encrypted, include the password (`sslPass`).
9283

9384
```js
9485
var MongoClient = require('mongodb').MongoClient,
@@ -102,27 +93,23 @@ var key = fs.readFileSync(__dirname + "/ssl/client.pem");
10293

10394
// Connect validating the returned certificates from the server
10495
MongoClient.connect("mongodb://localhost:27017/test?ssl=true", {
105-
server: {
106-
sslValidate:true
107-
, sslCA:ca
108-
, sslKey:key
109-
, sslCert:cert
110-
, sslPass:'10gen'
111-
}
96+
sslValidate:true,
97+
sslCA:ca,
98+
sslKey:key,
99+
sslCert:cert,
100+
sslPass:'10gen',
112101
}, function(err, db) {
113102
db.close();
114103
});
115-
116104
```
117105

118106
## Connect with X.509
119-
120107
[X.509](http://docs.mongodb.org/manual/core/authentication/#x-509-certificate-authentication) authentication requires the use of TLS/SSL connections with certificate validation. MongoDB uses the X.509 certificate presented during SSL negotiation to authenticate a user whose name is derived from the distinguished name of the X.509 certificate.
121108

122109
To connect using the X.509 authentication mechanism, specify `MONGODB-CR` as the mechanism in the [URI connection string](https://docs.mongodb.org/manual/reference/connection-string/), `ssl=true`, and the username. Use `enodeURIComponent` to encode the username string.
123110

124111
In addition to the connection string, pass to the `MongoClient.connect` method
125-
a connections options for the `server` with the X.509 certificate and other [TLS/SSL connections]({{< relref "tutorials/connect/ssl.md" >}}) options.
112+
a connections options with the X.509 certificate and other [TLS/SSL connections]({{< relref "reference/connecting/connection-settings.md" >}}) options.
126113

127114
```js
128115
var MongoClient = require('mongodb').MongoClient,
@@ -139,14 +126,11 @@ var userName = "CN=client,OU=kerneluser,O=10Gen,L=New York City,ST=New York,C=US
139126
// Connect using the MONGODB-X509 authentication mechanism
140127
MongoClient.connect(f('mongodb://%s@server:27017/test?authMechanism=%s&ssl=true'
141128
, encodeURIComponent(userName), 'MONGODB-X509'), {
142-
server: {
143-
sslKey:key
144-
, sslCert:cert
145-
}
129+
sslKey:key,
130+
sslCert:cert,
146131
}, function(err, db) {
147132
db.close();
148133
});
149-
150134
```
151135

152136
## TLS/SSL Options
@@ -161,79 +145,62 @@ The following TLS/SSL options are available.
161145
| `sslCert` | {Buffer\|string, default: null} | String or buffer containing the client certificate. |
162146
| `sslPass` | {Buffer\|string, default: null} | String or buffer containing the client certificate password. |
163147

164-
To connect to a single MongoDB instance, specify the TLS/SSL connection options for `server`.
165-
148+
To connect to a single MongoDB instance, specify the TLS/SSL connection options.
166149

167150
```js
168-
169151
var MongoClient = require('mongodb').MongoClient,
170152
fs = require('fs');
171153

172-
173154
// Read the certificates
174-
175155
var ca = [fs.readFileSync(__dirname + "/ssl/ca.pem")];
176156
var cert = fs.readFileSync(__dirname + "/ssl/client.pem");
177157
var key = fs.readFileSync(__dirname + "/ssl/client.pem");
178158

179159
MongoClient.connect('mongodb://server:27017/test?ssl=true', {
180-
server: {
181-
sslCA:ca
182-
, sslKey:key
183-
, sslCert:cert
184-
}
160+
sslCA:ca,
161+
sslKey:key,
162+
sslCert:cert,
185163
}, function(err, db) {
186164
db.close();
187165
});
188-
189166
```
190167

191-
192-
To connect to a replica set, specify the TLS/SSL connection options for `replset` .
168+
To connect to a replica set, specify the TLS/SSL connection options.
193169

194170
```js
195171
var MongoClient = require('mongodb').MongoClient,
196172
fs = require('fs');
197173

198174
// Read the certificates
199-
200175
var ca = [fs.readFileSync(__dirname + "/ssl/ca.pem")];
201176
var cert = fs.readFileSync(__dirname + "/ssl/client.pem");
202177
var key = fs.readFileSync(__dirname + "/ssl/client.pem");
203178

204-
205179
MongoClient.connect('mongodb://server:27017/test?replicaSet=foo&ssl=true', {
206-
replset: {
207-
sslCA:ca
208-
, sslKey:key
209-
, sslCert:cert
210-
}
180+
sslCA:ca,
181+
sslKey:key,
182+
sslCert:cert,
211183
}, function(err, db) {
212184
db.close();
213185
});
214-
215186
```
216187

217-
To connect to a replica set, specify the TLS/SSL connection options for `mongos`.
188+
To connect to a mongos we pass in the options at the top level, just as for replicasets and single server connections.
218189

219190
```js
220191
var MongoClient = require('mongodb').MongoClient,
221192
fs = require('fs');
222193

223194
// Read the certificates
224-
225195
var ca = [fs.readFileSync(__dirname + "/ssl/ca.pem")];
226196
var cert = fs.readFileSync(__dirname + "/ssl/client.pem");
227197
var key = fs.readFileSync(__dirname + "/ssl/client.pem");
228198

229199
MongoClient.connect('mongodb://server:27017/test?ssl=true', {
230-
mongos: {
231-
sslCA:ca
232-
, sslKey:key
233-
, sslCert:cert
234-
}
200+
sslCA:ca,
201+
sslKey:key,
202+
sslCert:cert,
235203
}, function(err, db) {
236204
db.close();
237205
});
238-
239206
```

0 commit comments

Comments
 (0)