@@ -23,7 +23,7 @@ Overview
23
23
In this guide, you can learn how to use the :wikipedia:`TLS <Transport_Layer_Security>`
24
24
protocol to secure your connection to a MongoDB deployment.
25
25
26
- When you enable TLS for a connection, the {+driver -short+} performs the following actions:
26
+ When you enable TLS for a connection, the {+library -short+} performs the following actions:
27
27
28
28
- Uses TLS to connect to the MongoDB deployment
29
29
- Verifies the deployment's certificate
@@ -41,7 +41,7 @@ To learn how to configure your MongoDB deployment for TLS, see the
41
41
42
42
.. tip::
43
43
44
- The {+driver -short+} delegates most TLS behavior to the MongoDB C Driver.
44
+ The {+library -short+} delegates most TLS behavior to the MongoDB C Driver.
45
45
For information about how the C driver handles TLS, including configuration steps
46
46
and expected behavior, see
47
47
`Configuring TLS <https://www.mongodb.com/docs/languages/c/c-driver/current/libmongoc/guides/configuring_tls/#supported-libraries>`__
@@ -78,7 +78,7 @@ signed by a well-known CA (certificate authority), and your application relies o
78
78
to validate the certificate.
79
79
80
80
During testing, however, you might want to act as your own CA.
81
- In this case, you must instruct the {+driver -short+} to
81
+ In this case, you must instruct the {+library -short+} to
82
82
use your CA certificates instead of ones signed by another CA.
83
83
84
84
To do so, use the ``tlsCAFile`` connection option to specify the path to a ``.pem`` file
@@ -95,7 +95,7 @@ Specify a CA Directory
95
95
96
96
If you are using OpenSSL or LibreSSL (``libtls``) for TLS support, you can also use
97
97
the ``ca_dir`` option to instruct
98
- the {+driver -short+} to search for a CA file within a directory. The driver searches this
98
+ the {+library -short+} to search for a CA file within a directory. The driver searches this
99
99
directory if it doesn't find a CA file at the path specified in the ``tlsCAFile`` option.
100
100
101
101
The following code example shows how to use the ``driverOptions`` parameter to specify the
@@ -119,7 +119,7 @@ Check Certificate Revocation
119
119
----------------------------
120
120
121
121
When an X.509 certificate is no longer trustworthy—for example, if its private key
122
- has been compromised—the CA revokes the certificate. The {+driver -short+} includes two ways
122
+ has been compromised—the CA revokes the certificate. The {+library -short+} includes two ways
123
123
to check whether a server's certificate has been revoked.
124
124
125
125
.. _php-disable-ocsp:
@@ -131,15 +131,15 @@ The Online Certificate Status Protocol (OCSP) process varies depending on the ve
131
131
{+mdb-server+} you're connecting to:
132
132
133
133
- **MongoDB v4.4 or later:** The server staples a
134
- time-stamped OCSP response to its certificate. The {+driver -short+} validates the certificate
134
+ time-stamped OCSP response to its certificate. The {+library -short+} validates the certificate
135
135
against the OCSP response. If the CA has revoked the certificate, or if the OCSP response
136
136
is otherwise invalid, the TLS handshake fails.
137
- - **MongoDB v4.3 or earlier:** The server supplies an OCSP endpoint, which the {+driver -short+}
138
- contacts directly. The {+driver -short+} then validates the certificate against the OCSP
137
+ - **MongoDB v4.3 or earlier:** The server supplies an OCSP endpoint, which the {+library -short+}
138
+ contacts directly. The {+library -short+} then validates the certificate against the OCSP
139
139
response. If the CA hasn't revoked the certificate, the TLS handshake continues, even if
140
140
the OCSP response is invalid or malformed.
141
141
142
- To stop the {+driver -short+} from contacting the OCSP endpoint, set the
142
+ To stop the {+library -short+} from contacting the OCSP endpoint, set the
143
143
``tlsDisableOCSPEndpointCheck`` connection option to ``true``.
144
144
You can do this in two ways: by passing an argument to the
145
145
``MongoDB\Client`` constructor or through a parameter in your connection string.
@@ -148,15 +148,15 @@ You can do this in two ways: by passing an argument to the
148
148
149
149
.. note::
150
150
151
- Even if the ``tlsDisableOCSPEndpointCheck`` option is set to ``true``, the {+driver -short+}
151
+ Even if the ``tlsDisableOCSPEndpointCheck`` option is set to ``true``, the {+library -short+}
152
152
still verifies any OCSP response stapled to a server's certificate.
153
153
154
154
.. _php-crl:
155
155
156
156
Certificate Revocation List
157
157
~~~~~~~~~~~~~~~~~~~~~~~~~~~
158
158
159
- Instead of using OCSP, you can use the instruct the {+driver -short+}
159
+ Instead of using OCSP, you can use the instruct the {+library -short+}
160
160
to check the server's certificate
161
161
against a Certificate Revocation List (CRL) published by the CA. To do so, set the
162
162
``crl_file`` option to the file path of the CRL. Include this option in the
@@ -177,7 +177,7 @@ Present a Client Certificate
177
177
----------------------------
178
178
179
179
Some MongoDB deployments require every connecting application to present a client certificate
180
- that proves its identity. To specify the client certificate for the {+driver -short+} to
180
+ that proves its identity. To specify the client certificate for the {+library -short+} to
181
181
present, set the ``tleCertificateKeyFile`` option to the file path of the ``.pem`` file that
182
182
contains your certificate and private key.
183
183
@@ -214,7 +214,7 @@ of the ``MongoDB\Client`` constructor or through a parameter in your connection
214
214
Allow Insecure TLS
215
215
------------------
216
216
217
- When TLS is enabled, the {+driver -short+} automatically verifies the certificate that
217
+ When TLS is enabled, the {+library -short+} automatically verifies the certificate that
218
218
the server presents. When testing your code, you can disable this verification.
219
219
This is known as *insecure TLS.*
220
220
@@ -262,7 +262,7 @@ To disable only hostname verification, set the ``tlsAllowInvalidHostnames`` opti
262
262
API Documentation
263
263
-----------------
264
264
265
- To learn more about configuring TLS for the {+driver -short+},
265
+ To learn more about configuring TLS for the {+library -short+},
266
266
see the following API documentation:
267
267
268
- - :ref :`MongoDB\Client <php-mongodb-client> `
268
+ - :phpclass :`MongoDB\Client`
0 commit comments