Uploaded image for project: 'Documentation'
  1. Documentation
  2. DOCS-14322

Investigate changes in SERVER-55119: Create startup warning indicating that X.509 certificates without SANs are deprecated

    XMLWordPrintable

Details

    Description

      Description

      Downstream Change Summary

      Following line needs to be added to release notes:

      • TLS connections would now issue a startup warning when their certificates do not include Subject Alternative Name attribute

      Description of Linked Ticket

      X.509 certificates have had two mechanisms for defining the hostname they bind their public key to.
      If a Subject Alternative Name is present in the certificate, the names defined there are considered to be bound.
      If no SAN is present, but the certificate's subject name contains a Common Name component, and that Common Name was interpretable as a hostname, that hostname was considered bound.

      The Common Name has been considered deprecated by Subject Alternative Names, because Common Names don't, semantically, have anything to do with hostnames.

      Various cryptographic libraries are removing support for hostname validation via common names. Apple's TLS framework stopped recognizing common names in iOS 13 and MacOS 10.15. Go 1.15 no longer recognizes common names by default, and the tunable knob will be removed in a future release.

      Clients using these platforms will find themselves unable to connect to MongoDB servers which use X509 certificate whose hostnames are advertised by CommonName attributes.

      We should indicate that these style of certificates are deprecated and should be replaced to all administrators whose servers use them. We should parse the server's server certificate at startup and emit a startup warning if it doesn't have a SAN. We should backport this change to all supported releases.

      Scope of changes

      Impact to Other Docs

      MVP (Work and Date)

      Resources (Scope or Design Docs, Invision, etc.)

      Attachments

        Issue Links

          Activity

            People

              ian.fogelman@mongodb.com Ian Fogelman
              backlog-server-pm Backlog - Core Eng Program Management Team
              Githook User Githook User
              Sergey Galtsev (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                45 weeks ago