-
Type:
Investigation
-
Resolution: Unresolved
-
Priority:
Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
-
None
It would be very convenient if passing in-memory TLS PEM options (tlsCAFile, tlsCertificateKeyFile) to the driver did not require creating a temporary file to store them and passing the filename to the driver.
For the main driver options, this is already the case because Node.js TLS options can be passed through; for AutoEncryptionTlsOptions this is currently not possible.
Acceptance Criteria:
- Utilize secureContext to pass tlsCAFile & tlsCertificateKeyFile as in memory options to both the auto encrypter (MongoClientOptions.autoEncryption.tlsOptions) and ClientEncryption.
If the driver-specific options are provided and a secure context is provided, the secure context takes precedence.
Testing Requirements:
- Test that both `ca` and `cert` can be provided as in-memory buffers in a secure context for auto encryption and explicit encryption (this ticket's primary motivator).
- Test that when a secure context is provided, the secure context is passed into the tls.connect() factory method when establishing a TLS connection.
- Test that when both the driver's TLS options (tlsCAFile & tlsCertificateKeyFile) and a secure context are provided, all options are passed.
Docs Requirements:
TBD (likely want both API and MongoDB manual docs to explain precedence rules)- N/A - decided not to do any special precedence handling
- depends on
-
NODE-4179 Accept Node.js TLS options in AutoEncryptionTlsOptions
-
- Closed
-
- is duplicated by
-
COMPASS-9561 Investigate changes in NODE-7032: Align TLS option handling in the driver
-
- Closed
-