[SERVER-55119] Create startup warning indicating that X.509 certificates without SANs are deprecated Created: 10/Mar/21 Updated: 29/Oct/23 Resolved: 29/Mar/21 |
|
| Status: | Closed |
| Project: | Core Server |
| Component/s: | Admin, Networking, Security |
| Affects Version/s: | None |
| Fix Version/s: | 4.2.15, 4.4.7, 5.0.0-rc0, 4.0.26 |
| Type: | Question | Priority: | Major - P3 |
| Reporter: | Spencer Jackson | Assignee: | Sergey Galtsev (Inactive) |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||||||||||||||
| Backwards Compatibility: | Minor Change | ||||||||||||||||||||
| Backport Requested: |
v5.0, v4.4, v4.2, v4.0
|
||||||||||||||||||||
| Sprint: | Security 2021-04-05 | ||||||||||||||||||||
| Participants: | |||||||||||||||||||||
| Case: | (copied to CRM) | ||||||||||||||||||||
| Description |
|
X.509 certificates have had two mechanisms for defining the hostname they bind their public key to. The Common Name has been considered deprecated by Subject Alternative Names, because Common Names don't, semantically, have anything to do with hostnames. Various cryptographic libraries are removing support for hostname validation via common names. Apple's TLS framework stopped recognizing common names in iOS 13 and MacOS 10.15. Go 1.15 no longer recognizes common names by default, and the tunable knob will be removed in a future release. Clients using these platforms will find themselves unable to connect to MongoDB servers which use X509 certificate whose hostnames are advertised by CommonName attributes. We should indicate that these style of certificates are deprecated and should be replaced to all administrators whose servers use them. We should parse the server's server certificate at startup and emit a startup warning if it doesn't have a SAN. We should backport this change to all supported releases. |
| Comments |
| Comment by Githook User [ 23/Jun/21 ] |
|
Author: {'name': 'sergey.galtsev', 'email': 'sergey.galtsev@mongodb.com', 'username': 'brushless-glitch'}Message: |
| Comment by Githook User [ 22/Jun/21 ] |
|
Author: {'name': 'sergey.galtsev', 'email': 'sergey.galtsev@mongodb.com', 'username': 'brushless-glitch'}Message: |
| Comment by Githook User [ 22/Jun/21 ] |
|
Author: {'name': 'sergey.galtsev', 'email': 'sergey.galtsev@mongodb.com', 'username': 'brushless-glitch'}Message: |
| Comment by Githook User [ 18/Jun/21 ] |
|
Author: {'name': 'sergey.galtsev', 'email': 'sergey.galtsev@mongodb.com', 'username': 'brushless-glitch'}Message: |
| Comment by Githook User [ 29/Mar/21 ] |
|
Author: {'name': 'Sergey Galtsev', 'email': 'sergey.galtsev@mongodb.com', 'username': 'brushless-glitch'}Message: |