SERVER-49112 Add Session::getSSLConfiguration

30 files changed, 243 insertions, 75 deletions

diff --git a/src/mongo/client/async_client.cpp b/src/mongo/client/async_client.cpp
index 55cf701b484..41d08e5245e 100644
--- a/src/mongo/client/async_client.cpp
+++ b/src/mongo/client/async_client.cpp
@@ -52,6 +52,7 @@
 #include "mongo/rpc/reply_interface.h"
 #include "mongo/util/net/socket_utils.h"
 #include "mongo/util/net/ssl_manager.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/version.h"
 
 namespace mongo {
@@ -153,8 +154,9 @@ Future<void> AsyncDBClient::authenticate(const BSONObj& params) {
     // We will only have a valid clientName if SSL is enabled.
     std::string clientName;
 #ifdef MONGO_CONFIG_SSL
-    if (getSSLManager()) {
-        clientName = getSSLManager()->getSSLConfiguration().clientSubjectName.toString();
+    auto sslConfiguration = _session->getSSLConfiguration();
+    if (sslConfiguration) {
+        clientName = sslConfiguration->clientSubjectName.toString();
     }
 #endif
 
@@ -169,8 +171,9 @@ Future<void> AsyncDBClient::authenticateInternal(boost::optional<std::string> me
     // We will only have a valid clientName if SSL is enabled.
     std::string clientName;
 #ifdef MONGO_CONFIG_SSL
-    if (getSSLManager()) {
-        clientName = getSSLManager()->getSSLConfiguration().clientSubjectName.toString();
+    auto sslConfiguration = _session->getSSLConfiguration();
+    if (sslConfiguration) {
+        clientName = sslConfiguration->clientSubjectName.toString();
     }
 #endif
 
diff --git a/src/mongo/client/dbclient_base.cpp b/src/mongo/client/dbclient_base.cpp
index f13eb6a1b3c..83f2bfb98bc 100644
--- a/src/mongo/client/dbclient_base.cpp
+++ b/src/mongo/client/dbclient_base.cpp
@@ -461,8 +461,9 @@ void DBClientBase::_auth(const BSONObj& params) {
     // We will only have a client name if SSL is enabled
     std::string clientName = "";
 #ifdef MONGO_CONFIG_SSL
-    if (getSSLManager() != nullptr) {
-        clientName = getSSLManager()->getSSLConfiguration().clientSubjectName.toString();
+    auto sslConfiguration = getSSLConfiguration();
+    if (sslConfiguration) {
+        clientName = sslConfiguration->clientSubjectName.toString();
     }
 #endif
 
@@ -488,8 +489,9 @@ Status DBClientBase::authenticateInternalUser(auth::StepDownBehavior stepDownBeh
     // We will only have a client name if SSL is enabled
     std::string clientName = "";
 #ifdef MONGO_CONFIG_SSL
-    if (getSSLManager() != nullptr) {
-        clientName = getSSLManager()->getSSLConfiguration().clientSubjectName.toString();
+    auto sslConfiguration = getSSLConfiguration();
+    if (sslConfiguration) {
+        clientName = sslConfiguration->clientSubjectName.toString();
     }
 #endif
 
diff --git a/src/mongo/client/dbclient_base.h b/src/mongo/client/dbclient_base.h
index 4da50dcb286..6f6633496f1 100644
--- a/src/mongo/client/dbclient_base.h
+++ b/src/mongo/client/dbclient_base.h
@@ -40,6 +40,7 @@
 #include "mongo/client/mongo_uri.h"
 #include "mongo/client/query.h"
 #include "mongo/client/read_preference.h"
+#include "mongo/config.h"
 #include "mongo/db/dbmessage.h"
 #include "mongo/db/jsobj.h"
 #include "mongo/db/write_concern_options.h"
@@ -755,6 +756,13 @@ public:
     // This is only for DBClientCursor.
     static void (*withConnection_do_not_use)(std::string host, std::function<void(DBClientBase*)>);
 
+#ifdef MONGO_CONFIG_SSL
+    /**
+     * Get the SSL configuration of this client.
+     */
+    virtual const SSLConfiguration* getSSLConfiguration() = 0;
+#endif
+
 protected:
     /** if the result of a command is ok*/
     bool isOk(const BSONObj&);
diff --git a/src/mongo/client/dbclient_connection.cpp b/src/mongo/client/dbclient_connection.cpp
index 4b24f0652d2..08437ffc366 100644
--- a/src/mongo/client/dbclient_connection.cpp
+++ b/src/mongo/client/dbclient_connection.cpp
@@ -77,6 +77,7 @@
 #include "mongo/util/net/socket_utils.h"
 #include "mongo/util/net/ssl_manager.h"
 #include "mongo/util/net/ssl_options.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/password_digest.h"
 #include "mongo/util/time_support.h"
 #include "mongo/util/version.h"
@@ -823,6 +824,12 @@ void DBClientConnection::handleNotMasterResponse(const BSONObj& replyBody,
     _markFailed(kSetFlag);
 }
 
+#ifdef MONGO_CONFIG_SSL
+const SSLConfiguration* DBClientConnection::getSSLConfiguration() {
+    return _session->getSSLConfiguration();
+}
+#endif
+
 AtomicWord<int> DBClientConnection::_numConnections;
 
 }  // namespace mongo
diff --git a/src/mongo/client/dbclient_connection.h b/src/mongo/client/dbclient_connection.h
index 340c8670b3d..db6c0c2a567 100644
--- a/src/mongo/client/dbclient_connection.h
+++ b/src/mongo/client/dbclient_connection.h
@@ -39,6 +39,7 @@
 #include "mongo/client/mongo_uri.h"
 #include "mongo/client/query.h"
 #include "mongo/client/read_preference.h"
+#include "mongo/config.h"
 #include "mongo/db/dbmessage.h"
 #include "mongo/db/jsobj.h"
 #include "mongo/db/write_concern_options.h"
@@ -307,6 +308,10 @@ public:
         return _authenticatedDuringConnect;
     }
 
+#ifdef MONGO_CONFIG_SSL
+    const SSLConfiguration* getSSLConfiguration() override;
+#endif
+
 protected:
     int _minWireVersion{0};
     int _maxWireVersion{0};
diff --git a/src/mongo/client/dbclient_rs.cpp b/src/mongo/client/dbclient_rs.cpp
index 68ac0b84b50..86f35c50ef6 100644
--- a/src/mongo/client/dbclient_rs.cpp
+++ b/src/mongo/client/dbclient_rs.cpp
@@ -42,6 +42,7 @@
 #include "mongo/client/global_conn_pool.h"
 #include "mongo/client/read_preference.h"
 #include "mongo/client/replica_set_monitor.h"
+#include "mongo/config.h"
 #include "mongo/db/auth/sasl_command_constants.h"
 #include "mongo/db/dbmessage.h"
 #include "mongo/db/jsobj.h"
@@ -1209,4 +1210,10 @@ void DBClientReplicaSet::resetSlaveOkConn() {
     _lastSlaveOkHost = HostAndPort();
 }
 
+#ifdef MONGO_CONFIG_SSL
+const SSLConfiguration* DBClientReplicaSet::getSSLConfiguration() {
+    return checkMaster()->getSSLConfiguration();
+}
+#endif
+
 }  // namespace mongo
diff --git a/src/mongo/client/dbclient_rs.h b/src/mongo/client/dbclient_rs.h
index 4069576cba0..4710a300c5d 100644
--- a/src/mongo/client/dbclient_rs.h
+++ b/src/mongo/client/dbclient_rs.h
@@ -37,6 +37,7 @@
 
 #include "mongo/client/dbclient_connection.h"
 #include "mongo/client/mongo_uri.h"
+#include "mongo/config.h"
 #include "mongo/util/net/hostandport.h"
 
 namespace mongo {
@@ -258,6 +259,10 @@ public:
      */
     static void setAuthPooledSecondaryConn(bool setting);
 
+#ifdef MONGO_CONFIG_SSL
+    const SSLConfiguration* getSSLConfiguration() override;
+#endif
+
 protected:
     /** Authorize.  Authorizes all nodes as needed
      */
diff --git a/src/mongo/db/auth/authorization_manager_impl.cpp b/src/mongo/db/auth/authorization_manager_impl.cpp
index 7e161867017..e793b33f51d 100644
--- a/src/mongo/db/auth/authorization_manager_impl.cpp
+++ b/src/mongo/db/auth/authorization_manager_impl.cpp
@@ -55,6 +55,7 @@
 #include "mongo/db/mongod_options.h"
 #include "mongo/logv2/log.h"
 #include "mongo/util/assert_util.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/net/ssl_types.h"
 #include "mongo/util/str.h"
 
diff --git a/src/mongo/db/auth/authorization_manager_test.cpp b/src/mongo/db/auth/authorization_manager_test.cpp
index b0e24ccaa38..cf30c5fbf4d 100644
--- a/src/mongo/db/auth/authorization_manager_test.cpp
+++ b/src/mongo/db/auth/authorization_manager_test.cpp
@@ -53,6 +53,7 @@
 #include "mongo/transport/session.h"
 #include "mongo/transport/transport_layer_mock.h"
 #include "mongo/unittest/unittest.h"
+#include "mongo/util/net/ssl_peer_info.h"
 
 #define ASSERT_NULL(EXPR) ASSERT_FALSE(EXPR)
 #define ASSERT_NON_NULL(EXPR) ASSERT_TRUE(EXPR)
diff --git a/src/mongo/db/commands/authentication_commands.cpp b/src/mongo/db/commands/authentication_commands.cpp
index 1030b67f336..166bbd3ebe9 100644
--- a/src/mongo/db/commands/authentication_commands.cpp
+++ b/src/mongo/db/commands/authentication_commands.cpp
@@ -61,6 +61,7 @@
 #include "mongo/transport/session.h"
 #include "mongo/util/concurrency/mutex.h"
 #include "mongo/util/net/ssl_manager.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/net/ssl_types.h"
 #include "mongo/util/text.h"
 
@@ -88,7 +89,9 @@ Status _authenticateX509(OperationContext* opCtx, const UserName& user, const BS
             "No verified subject name available from client",
             !clientName.empty());
 
-    if (!getSSLManager()->getSSLConfiguration().hasCA) {
+    auto sslConfiguration = opCtx->getClient()->session()->getSSLConfiguration();
+
+    if (!sslConfiguration->hasCA) {
         return Status(ErrorCodes::AuthenticationFailed,
                       "Unable to verify x.509 certificate, as no CA has been provided.");
     } else if (user.getUser() != clientName.toString()) {
@@ -96,7 +99,7 @@ Status _authenticateX509(OperationContext* opCtx, const UserName& user, const BS
                       "There is no x.509 client certificate matching the user.");
     } else {
         // Handle internal cluster member auth, only applies to server-server connections
-        if (getSSLManager()->getSSLConfiguration().isClusterMember(clientName)) {
+        if (sslConfiguration->isClusterMember(clientName)) {
             int clusterAuthMode = serverGlobalParams.clusterAuthMode.load();
             if (clusterAuthMode == ServerGlobalParams::ClusterAuthMode_undefined ||
                 clusterAuthMode == ServerGlobalParams::ClusterAuthMode_keyFile) {
diff --git a/src/mongo/db/commands/user_management_commands.cpp b/src/mongo/db/commands/user_management_commands.cpp
index 8fc24ce6d79..d6f95c0e64f 100644
--- a/src/mongo/db/commands/user_management_commands.cpp
+++ b/src/mongo/db/commands/user_management_commands.cpp
@@ -843,7 +843,8 @@ void CmdUMCTyped<CreateUserCommand, void>::Invocation::typedRun(OperationContext
             "Cannot create an x.509 user with a subjectname that would be "
             "recognized as an internal cluster member",
             (dbname != "$external") || !getSSLManager() ||
-                !getSSLManager()->getSSLConfiguration().isClusterMember(userName.getUser()));
+                !opCtx->getClient()->session()->getSSLConfiguration()->isClusterMember(
+                    userName.getUser()));
 #endif
 
     // Synthesize a user document
diff --git a/src/mongo/db/dbdirectclient.h b/src/mongo/db/dbdirectclient.h
index 0554334d6fd..8f0ac5ec334 100644
--- a/src/mongo/db/dbdirectclient.h
+++ b/src/mongo/db/dbdirectclient.h
@@ -30,6 +30,7 @@
 #pragma once
 
 #include "mongo/client/dbclient_base.h"
+#include "mongo/config.h"
 #include "mongo/db/dbmessage.h"
 #include "mongo/db/lasterror.h"
 #include "mongo/util/net/hostandport.h"
@@ -107,6 +108,13 @@ public:
         return false;
     }
 
+#ifdef MONGO_CONFIG_SSL
+    const SSLConfiguration* getSSLConfiguration() override {
+        invariant(false);
+        return nullptr;
+    }
+#endif
+
 private:
     OperationContext* _opCtx;
     LastError _lastError;  // This LastError will be used for all operations on this client.
diff --git a/src/mongo/shell/encrypted_dbclient_base.cpp b/src/mongo/shell/encrypted_dbclient_base.cpp
index f08af53e152..d190c5ebac3 100644
--- a/src/mongo/shell/encrypted_dbclient_base.cpp
+++ b/src/mongo/shell/encrypted_dbclient_base.cpp
@@ -35,6 +35,7 @@
 #include "mongo/base/data_type_validated.h"
 #include "mongo/bson/bson_depth.h"
 #include "mongo/client/dbclient_base.h"
+#include "mongo/config.h"
 #include "mongo/crypto/aead_encryption.h"
 #include "mongo/crypto/fle_data_frames.h"
 #include "mongo/crypto/symmetric_crypto.h"
@@ -645,6 +646,12 @@ std::shared_ptr<SymmetricKey> EncryptedDBClientBase::getDataKeyFromDisk(const UU
         std::move(decryptedKey), crypto::aesAlgorithm, "kms_encryption");
 }
 
+#ifdef MONGO_CONFIG_SSL
+const SSLConfiguration* EncryptedDBClientBase::getSSLConfiguration() {
+    return _conn->getSSLConfiguration();
+}
+#endif
+
 namespace {
 
 /**
diff --git a/src/mongo/shell/encrypted_dbclient_base.h b/src/mongo/shell/encrypted_dbclient_base.h
index 406c5884391..4281513cada 100644
--- a/src/mongo/shell/encrypted_dbclient_base.h
+++ b/src/mongo/shell/encrypted_dbclient_base.h
@@ -33,6 +33,7 @@
 #include "mongo/base/data_type_validated.h"
 #include "mongo/bson/bson_depth.h"
 #include "mongo/client/dbclient_base.h"
+#include "mongo/config.h"
 #include "mongo/crypto/aead_encryption.h"
 #include "mongo/crypto/symmetric_crypto.h"
 #include "mongo/db/client.h"
@@ -140,6 +141,10 @@ public:
 
     bool isMongos() const final;
 
+#ifdef MONGO_CONFIG_SSL
+    const SSLConfiguration* getSSLConfiguration() override;
+#endif
+
 protected:
     std::pair<rpc::UniqueReply, DBClientBase*> processResponse(rpc::UniqueReply result,
                                                                const StringData databaseName);
diff --git a/src/mongo/transport/SConscript b/src/mongo/transport/SConscript
index ab1e34c702b..b5431d1db2a 100644
--- a/src/mongo/transport/SConscript
+++ b/src/mongo/transport/SConscript
@@ -15,6 +15,7 @@ env.Library(
     LIBDEPS=[
         '$BUILD_DIR/mongo/base',
         '$BUILD_DIR/mongo/db/service_context',
+        '$BUILD_DIR/mongo/util/net/ssl_manager',
     ],
 )
 
diff --git a/src/mongo/transport/mock_session.h b/src/mongo/transport/mock_session.h
index d9a6984f5b5..8fcb6fc789a 100644
--- a/src/mongo/transport/mock_session.h
+++ b/src/mongo/transport/mock_session.h
@@ -30,6 +30,7 @@
 #pragma once
 
 #include "mongo/base/checked_cast.h"
+#include "mongo/config.h"
 #include "mongo/transport/session.h"
 #include "mongo/transport/transport_layer_mock.h"
 #include "mongo/util/net/hostandport.h"
@@ -123,6 +124,12 @@ public:
         return true;
     }
 
+#ifdef MONGO_CONFIG_SSL
+    virtual const SSLConfiguration* getSSLConfiguration() const override {
+        return nullptr;
+    }
+#endif
+
     explicit MockSession(TransportLayer* tl)
         : _tl(checked_cast<TransportLayerMock*>(tl)), _remote(), _local() {}
     explicit MockSession(HostAndPort remote,
diff --git a/src/mongo/transport/service_state_machine.cpp b/src/mongo/transport/service_state_machine.cpp
index 2d28455793e..fb09fa9ad85 100644
--- a/src/mongo/transport/service_state_machine.cpp
+++ b/src/mongo/transport/service_state_machine.cpp
@@ -54,6 +54,7 @@
 #include "mongo/util/exit.h"
 #include "mongo/util/fail_point.h"
 #include "mongo/util/net/socket_exception.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/quick_exit.h"
 
 namespace mongo {
diff --git a/src/mongo/transport/session.cpp b/src/mongo/transport/session.cpp
index d3efb3051b6..c35d49aff1c 100644
--- a/src/mongo/transport/session.cpp
+++ b/src/mongo/transport/session.cpp
@@ -31,9 +31,13 @@
 
 #include "mongo/transport/session.h"
 
+#include "mongo/config.h"
 #include "mongo/platform/atomic_word.h"
 #include "mongo/transport/transport_layer.h"
+#ifdef MONGO_CONFIG_SSL
+#include "mongo/util/net/ssl_manager.h"
 #include "mongo/util/net/ssl_types.h"
+#endif
 
 namespace mongo {
 namespace transport {
diff --git a/src/mongo/transport/session.h b/src/mongo/transport/session.h
index 6f72aca8127..2f5aebb74f4 100644
--- a/src/mongo/transport/session.h
+++ b/src/mongo/transport/session.h
@@ -31,6 +31,7 @@
 
 #include <memory>
 
+#include "mongo/config.h"
 #include "mongo/db/baton.h"
 #include "mongo/platform/atomic_word.h"
 #include "mongo/rpc/message.h"
@@ -40,6 +41,9 @@
 #include "mongo/util/net/hostandport.h"
 #include "mongo/util/net/sockaddr.h"
 #include "mongo/util/time_support.h"
+#ifdef MONGO_CONFIG_SSL
+#include "mongo/util/net/ssl_types.h"
+#endif
 
 namespace mongo {
 namespace transport {
@@ -184,6 +188,13 @@ public:
 
     TagMask getTags() const;
 
+#ifdef MONGO_CONFIG_SSL
+    /**
+     * Get the configuration from the SSL manager.
+     */
+    virtual const SSLConfiguration* getSSLConfiguration() const = 0;
+#endif
+
 protected:
     Session();
 
diff --git a/src/mongo/transport/session_asio.h b/src/mongo/transport/session_asio.h
index bf19ccc31da..5795230daa6 100644
--- a/src/mongo/transport/session_asio.h
+++ b/src/mongo/transport/session_asio.h
@@ -41,6 +41,7 @@
 #include "mongo/util/net/socket_utils.h"
 #ifdef MONGO_CONFIG_SSL
 #include "mongo/util/net/ssl_manager.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/net/ssl_types.h"
 #endif
 
@@ -240,6 +241,16 @@ public:
         return false;
     }
 
+#ifdef MONGO_CONFIG_SSL
+    virtual const SSLConfiguration* getSSLConfiguration() const override {
+        auto sslManager = getSSLManager();
+        if (!sslManager) {
+            return nullptr;
+        }
+        return &sslManager->getSSLConfiguration();
+    }
+#endif
+
 protected:
     friend class TransportLayerASIO;
     friend TransportLayerASIO::BatonASIO;
diff --git a/src/mongo/transport/transport_layer_mock.h b/src/mongo/transport/transport_layer_mock.h
index eb095b1e65e..8d38a4c4ef5 100644
--- a/src/mongo/transport/transport_layer_mock.h
+++ b/src/mongo/transport/transport_layer_mock.h
@@ -33,6 +33,7 @@
 #include "mongo/stdx/unordered_map.h"
 #include "mongo/transport/session.h"
 #include "mongo/transport/transport_layer.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/net/ssl_types.h"
 #include "mongo/util/time_support.h"
 
diff --git a/src/mongo/util/net/SConscript b/src/mongo/util/net/SConscript
index ccdef1287b2..41ff54ec20b 100644
--- a/src/mongo/util/net/SConscript
+++ b/src/mongo/util/net/SConscript
@@ -96,7 +96,6 @@ env.Library(
         '$BUILD_DIR/mongo/base',
     ],
     LIBDEPS_PRIVATE=[
-        '$BUILD_DIR/mongo/transport/transport_layer_common',
         'ssl_options',
     ]
 )
@@ -122,6 +121,7 @@ if not get_option('ssl') == 'off':
             "ssl_parameters.cpp",
             "ssl_manager_%s.cpp" % (ssl_provider),
             "ssl_stream.cpp",
+            "ssl_peer_info.cpp",
             env.Idlc('ssl_parameters.idl')[0],
             "ocsp/ocsp_manager.cpp",
         ],
diff --git a/src/mongo/util/net/ssl_manager.h b/src/mongo/util/net/ssl_manager.h
index 8bcb12db721..979dc9f0f2f 100644
--- a/src/mongo/util/net/ssl_manager.h
+++ b/src/mongo/util/net/ssl_manager.h
@@ -44,6 +44,7 @@
 #include "mongo/util/decorable.h"
 #include "mongo/util/net/sock.h"
 #include "mongo/util/net/ssl/apple.hpp"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/net/ssl_types.h"
 #include "mongo/util/out_of_line_executor.h"
 #include "mongo/util/time_support.h"
@@ -117,26 +118,6 @@ public:
     virtual ~SSLConnectionInterface();
 };
 
-class SSLConfiguration {
-public:
-    bool isClusterMember(StringData subjectName) const;
-    bool isClusterMember(SSLX509Name subjectName) const;
-    void getServerStatusBSON(BSONObjBuilder*) const;
-    Status setServerSubjectName(SSLX509Name name);
-
-    const SSLX509Name& serverSubjectName() const {
-        return _serverSubjectName;
-    }
-
-    SSLX509Name clientSubjectName;
-    Date_t serverCertificateExpirationDate;
-    bool hasCA = false;
-
-private:
-    SSLX509Name _serverSubjectName;
-    std::vector<SSLX509Name::Entry> _canonicalServerSubjectName;
-};
-
 // These represent the ASN.1 type bytes for strings used in an X509 DirectoryString
 constexpr int kASN1BMPString = 30;
 constexpr int kASN1IA5String = 22;
diff --git a/src/mongo/util/net/ssl_manager_apple.cpp b/src/mongo/util/net/ssl_manager_apple.cpp
index c112e7db5ee..d96ee83ced1 100644
--- a/src/mongo/util/net/ssl_manager_apple.cpp
+++ b/src/mongo/util/net/ssl_manager_apple.cpp
@@ -55,6 +55,7 @@
 #include "mongo/util/net/ssl_manager.h"
 #include "mongo/util/net/ssl_options.h"
 #include "mongo/util/net/ssl_parameters_gen.h"
+#include "mongo/util/net/ssl_peer_info.h"
 
 using asio::ssl::apple::CFUniquePtr;
 
diff --git a/src/mongo/util/net/ssl_manager_openssl.cpp b/src/mongo/util/net/ssl_manager_openssl.cpp
index 3dc7325a90a..90fd2d5eba9 100644
--- a/src/mongo/util/net/ssl_manager_openssl.cpp
+++ b/src/mongo/util/net/ssl_manager_openssl.cpp
@@ -62,6 +62,7 @@
 #include "mongo/util/net/socket_exception.h"
 #include "mongo/util/net/ssl_options.h"
 #include "mongo/util/net/ssl_parameters_gen.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/net/ssl_types.h"
 #include "mongo/util/periodic_runner.h"
 #include "mongo/util/read_through_cache.h"
diff --git a/src/mongo/util/net/ssl_manager_windows.cpp b/src/mongo/util/net/ssl_manager_windows.cpp
index 5c87b0161b0..5eed0bdb6a1 100644
--- a/src/mongo/util/net/ssl_manager_windows.cpp
+++ b/src/mongo/util/net/ssl_manager_windows.cpp
@@ -61,6 +61,7 @@
 #include "mongo/util/net/ssl.hpp"
 #include "mongo/util/net/ssl_options.h"
 #include "mongo/util/net/ssl_parameters_gen.h"
+#include "mongo/util/net/ssl_peer_info.h"
 #include "mongo/util/net/ssl_types.h"
 #include "mongo/util/str.h"
 #include "mongo/util/text.h"
diff --git a/src/mongo/util/net/ssl_peer_info.cpp b/src/mongo/util/net/ssl_peer_info.cpp
new file mode 100644
index 00000000000..315fa751993
--- /dev/null
+++ b/src/mongo/util/net/ssl_peer_info.cpp
@@ -0,0 +1,46 @@
+/**
+ *    Copyright (C) 2018-present MongoDB, Inc.
+ *
+ *    This program is free software: you can redistribute it and/or modify
+ *    it under the terms of the Server Side Public License, version 1,
+ *    as published by MongoDB, Inc.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    Server Side Public License for more details.
+ *
+ *    You should have received a copy of the Server Side Public License
+ *    along with this program. If not, see
+ *    <http://www.mongodb.com/licensing/server-side-public-license>.
+ *
+ *    As a special exception, the copyright holders give permission to link the
+ *    code of portions of this program with the OpenSSL library under certain
+ *    conditions as described in each individual source file and distribute
+ *    linked combinations including the program with the OpenSSL library. You
+ *    must comply with the Server Side Public License in all respects for
+ *    all of the code used other than as permitted herein. If you modify file(s)
+ *    with this exception, you may extend this exception to your version of the
+ *    file(s), but you are not obligated to do so. If you do not wish to do so,
+ *    delete this exception statement from your version. If you delete this
+ *    exception statement from all source files in the program, then also delete
+ *    it in the license file.
+ */
+
+#include "mongo/platform/basic.h"
+
+#include "mongo/util/net/ssl_peer_info.h"
+
+namespace mongo {
+namespace {
+const transport::Session::Decoration<SSLPeerInfo> peerInfoForSession =
+    transport::Session::declareDecoration<SSLPeerInfo>();
+}
+SSLPeerInfo& SSLPeerInfo::forSession(const transport::SessionHandle& session) {
+    return peerInfoForSession(session.get());
+}
+
+const SSLPeerInfo& SSLPeerInfo::forSession(const transport::ConstSessionHandle& session) {
+    return peerInfoForSession(session.get());
+}
+}  // namespace mongo
\ No newline at end of file
diff --git a/src/mongo/util/net/ssl_peer_info.h b/src/mongo/util/net/ssl_peer_info.h
new file mode 100644
index 00000000000..b336fd95e18
--- /dev/null
+++ b/src/mongo/util/net/ssl_peer_info.h
@@ -0,0 +1,67 @@
+/**
+ *    Copyright (C) 2018-present MongoDB, Inc.
+ *
+ *    This program is free software: you can redistribute it and/or modify
+ *    it under the terms of the Server Side Public License, version 1,
+ *    as published by MongoDB, Inc.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    Server Side Public License for more details.
+ *
+ *    You should have received a copy of the Server Side Public License
+ *    along with this program. If not, see
+ *    <http://www.mongodb.com/licensing/server-side-public-license>.
+ *
+ *    As a special exception, the copyright holders give permission to link the
+ *    code of portions of this program with the OpenSSL library under certain
+ *    conditions as described in each individual source file and distribute
+ *    linked combinations including the program with the OpenSSL library. You
+ *    must comply with the Server Side Public License in all respects for
+ *    all of the code used other than as permitted herein. If you modify file(s)
+ *    with this exception, you may extend this exception to your version of the
+ *    file(s), but you are not obligated to do so. If you do not wish to do so,
+ *    delete this exception statement from your version. If you delete this
+ *    exception statement from all source files in the program, then also delete
+ *    it in the license file.
+ */
+
+#pragma once
+
+#include "mongo/transport/session.h"
+#include "mongo/util/net/ssl_types.h"
+
+namespace mongo {
+/**
+ * Contains information extracted from the peer certificate which is consumed by subsystems
+ * outside of the networking stack.
+ */
+struct SSLPeerInfo {
+    explicit SSLPeerInfo(SSLX509Name subjectName,
+                         boost::optional<std::string> sniName = {},
+                         stdx::unordered_set<RoleName> roles = {})
+        : isTLS(true),
+          subjectName(std::move(subjectName)),
+          sniName(std::move(sniName)),
+          roles(std::move(roles)) {}
+    SSLPeerInfo() = default;
+
+    explicit SSLPeerInfo(boost::optional<std::string> sniName)
+        : isTLS(true), sniName(std::move(sniName)) {}
+
+    /**
+     * This flag is used to indicate if the underlying socket is using TLS or not. A default
+     * constructor of SSLPeerInfo indicates that TLS is not being used, and the other
+     * constructors set its value to true.
+     */
+    bool isTLS = false;
+
+    SSLX509Name subjectName;
+    boost::optional<std::string> sniName;
+    stdx::unordered_set<RoleName> roles;
+
+    static SSLPeerInfo& forSession(const transport::SessionHandle& session);
+    static const SSLPeerInfo& forSession(const transport::ConstSessionHandle& session);
+};
+}  // namespace mongo
\ No newline at end of file
diff --git a/src/mongo/util/net/ssl_types.cpp b/src/mongo/util/net/ssl_types.cpp
index cc2f7e063ea..217da793c7c 100644
--- a/src/mongo/util/net/ssl_types.cpp
+++ b/src/mongo/util/net/ssl_types.cpp
@@ -35,21 +35,6 @@
 
 namespace mongo {
 
-namespace {
-
-const transport::Session::Decoration<SSLPeerInfo> peerInfoForSession =
-    transport::Session::declareDecoration<SSLPeerInfo>();
-
-}  // namespace
-
-SSLPeerInfo& SSLPeerInfo::forSession(const transport::SessionHandle& session) {
-    return peerInfoForSession(session.get());
-}
-
-const SSLPeerInfo& SSLPeerInfo::forSession(const transport::ConstSessionHandle& session) {
-    return peerInfoForSession(session.get());
-}
-
 const SSLParams& getSSLGlobalParams() {
     return sslGlobalParams;
 }
diff --git a/src/mongo/util/net/ssl_types.h b/src/mongo/util/net/ssl_types.h
index a006fd721e1..6f859ee01aa 100644
--- a/src/mongo/util/net/ssl_types.h
+++ b/src/mongo/util/net/ssl_types.h
@@ -34,7 +34,6 @@
 #include "mongo/bson/util/builder.h"
 #include "mongo/db/auth/role_name.h"
 #include "mongo/stdx/unordered_set.h"
-#include "mongo/transport/session.h"
 
 namespace mongo {
 
@@ -110,36 +109,24 @@ inline bool operator<(const SSLX509Name::Entry& lhs, const SSLX509Name::Entry& r
     return lhs.equalityLens() < rhs.equalityLens();
 }
 
-/**
- * Contains information extracted from the peer certificate which is consumed by subsystems
- * outside of the networking stack.
- */
-struct SSLPeerInfo {
-    explicit SSLPeerInfo(SSLX509Name subjectName,
-                         boost::optional<std::string> sniName = {},
-                         stdx::unordered_set<RoleName> roles = {})
-        : isTLS(true),
-          subjectName(std::move(subjectName)),
-          sniName(std::move(sniName)),
-          roles(std::move(roles)) {}
-    SSLPeerInfo() = default;
-
-    explicit SSLPeerInfo(boost::optional<std::string> sniName)
-        : isTLS(true), sniName(std::move(sniName)) {}
+class SSLConfiguration {
+public:
+    bool isClusterMember(StringData subjectName) const;
+    bool isClusterMember(SSLX509Name subjectName) const;
+    void getServerStatusBSON(BSONObjBuilder*) const;
+    Status setServerSubjectName(SSLX509Name name);
 
-    /**
-     * This flag is used to indicate if the underlying socket is using TLS or not. A default
-     * constructor of SSLPeerInfo indicates that TLS is not being used, and the other
-     * constructors set its value to true.
-     */
-    bool isTLS = false;
+    const SSLX509Name& serverSubjectName() const {
+        return _serverSubjectName;
+    }
 
-    SSLX509Name subjectName;
-    boost::optional<std::string> sniName;
-    stdx::unordered_set<RoleName> roles;
+    SSLX509Name clientSubjectName;
+    Date_t serverCertificateExpirationDate;
+    bool hasCA = false;
 
-    static SSLPeerInfo& forSession(const transport::SessionHandle& session);
-    static const SSLPeerInfo& forSession(const transport::ConstSessionHandle& session);
+private:
+    SSLX509Name _serverSubjectName;
+    std::vector<SSLX509Name::Entry> _canonicalServerSubjectName;
 };
 
 }  // namespace mongo