SERVER-17450 Cleanup SSL test infrastructure

29 files changed, 107 insertions, 231 deletions

diff --git a/buildscripts/smoke.py b/buildscripts/smoke.py
index ab8b53e9dee..783a2234109 100755
--- a/buildscripts/smoke.py
+++ b/buildscripts/smoke.py
@@ -252,14 +252,11 @@ class mongod(NullMongod):
             self.auth = True
         if self.kwargs.get('keyFile'):
             argv += ['--keyFile', self.kwargs.get('keyFile')]
-        if self.kwargs.get('use_ssl') or self.kwargs.get('use_x509'):
+        if self.kwargs.get('use_ssl'):
             argv += ['--sslMode', "requireSSL",
                      '--sslPEMKeyFile', 'jstests/libs/server.pem',
                      '--sslCAFile', 'jstests/libs/ca.pem',
-                     '--sslWeakCertificateValidation']
-        if self.kwargs.get('use_x509'):
-            argv += ['--clusterAuthMode','x509'];
-            self.auth = True
+                     '--sslAllowConnectionsWithoutCertificates']
         print "running " + " ".join(argv)
         self.proc = self._start(buildlogger(argv, is_global=True))
 
@@ -456,7 +453,7 @@ def skipTest(path):
         if basename in ["fastsync.js", "index_retry.js", "ttl_repl_maintenance.js", 
                         "unix_socket1.js"]:
             return True;
-    if auth or keyFile or use_x509: # For tests running with auth
+    if auth or keyFile: # For tests running with auth
         # Skip any tests that run with auth explicitly
         if parentDir.lower() == "auth" or "auth" in basename.lower():
             return True
@@ -588,9 +585,7 @@ def runTest(test, result):
                      'TestData.keyFile = ' + ternary( keyFile , '"' + str(keyFile) + '"' , 'null' ) + ";" + \
                      'TestData.keyFileData = ' + ternary( keyFile , '"' + str(keyFileData) + '"' , 'null' ) + ";" + \
                      'TestData.authMechanism = ' + ternary( authMechanism,
-                                               '"' + str(authMechanism) + '"', 'null') + ";" + \
-                     'TestData.useSSL = ' + ternary( use_ssl ) + ";" + \
-                     'TestData.useX509 = ' + ternary( use_x509 ) + ";"
+                                               '"' + str(authMechanism) + '"', 'null') + ";"
         # this updates the default data directory for mongod processes started through shell (src/mongo/shell/servers.js)
         evalString += 'MongoRunner.dataDir = "' + os.path.abspath(smoke_db_prefix + '/data/db') + '";'
         evalString += 'MongoRunner.dataPath = MongoRunner.dataDir + "/";'
@@ -702,8 +697,7 @@ def run_tests(tests):
                             auth=auth,
                             authMechanism=authMechanism,
                             keyFile=keyFile,
-                            use_ssl=use_ssl,
-                            use_x509=use_x509)
+                            use_ssl=use_ssl)
             master.start()
 
         if small_oplog:
@@ -730,8 +724,7 @@ def run_tests(tests):
                            auth=auth,
                            authMechanism=authMechanism,
                            keyFile=keyFile,
-                           use_ssl=use_ssl,
-                           use_x509=use_x509)
+                           use_ssl=use_ssl)
             slave.start()
             primary = Connection(port=master.port, slave_okay=True);
 
@@ -812,8 +805,7 @@ def run_tests(tests):
                                         auth=auth,
                                         authMechanism=authMechanism,
                                         keyFile=keyFile,
-                                        use_ssl=use_ssl,
-                                        use_x509=use_x509)
+                                        use_ssl=use_ssl)
                         master.start()
 
             except TestFailure, f:
@@ -1095,7 +1087,7 @@ def set_globals(options, tests):
     global small_oplog, small_oplog_rs
     global no_journal, set_parameters, set_parameters_mongos, no_preallocj, storage_engine, wiredtiger_engine_config_string, wiredtiger_collection_config_string, wiredtiger_index_config_string
     global auth, authMechanism, keyFile, keyFileData, smoke_db_prefix, test_path, start_mongod
-    global use_ssl, use_x509
+    global use_ssl
     global file_of_commands_mode
     global report_file, shell_write_mode, use_write_commands
     global temp_path
@@ -1105,9 +1097,6 @@ def set_globals(options, tests):
     start_mongod = options.start_mongod
     if hasattr(options, 'use_ssl'):
         use_ssl = options.use_ssl
-    if hasattr(options, 'use_x509'):
-        use_x509 = options.use_x509
-        use_ssl = use_ssl or use_x509
     #Careful, this can be called multiple times
     test_path = options.test_path
 
@@ -1298,9 +1287,6 @@ def main():
     parser.add_option('--auth', dest='auth', default=False,
                       action="store_true",
                       help='Run standalone mongods in tests with authentication enabled')
-    parser.add_option('--use-x509', dest='use_x509', default=False,
-                      action="store_true",
-                      help='Use x509 auth for internal cluster authentication')
     parser.add_option('--authMechanism', dest='authMechanism', default='SCRAM-SHA-1',
                       help='Use the given authentication mechanism, when --auth is used.')
     parser.add_option('--keyFile', dest='keyFile', default=None,
diff --git a/jstests/replsets/rslib.js b/jstests/replsets/rslib.js
index bb3b8374738..7111063f38e 100644
--- a/jstests/replsets/rslib.js
+++ b/jstests/replsets/rslib.js
@@ -47,7 +47,7 @@ reconnect = function(a) {
           db = a;
         }
         db.bar.stats();
-        if (jsTest.options().keyFile || jsTest.options().useX509) { // SERVER-4241: Shell connections don't re-authenticate on reconnect
+        if (jsTest.options().keyFile) { // SERVER-4241: Shell connections don't re-authenticate on reconnect
           return jsTest.authenticate(db.getMongo());
         }
         return true;
diff --git a/jstests/ssl/disable_x509.js b/jstests/ssl/disable_x509.js
index 8b3ec8957b6..57175aa0f94 100644
--- a/jstests/ssl/disable_x509.js
+++ b/jstests/ssl/disable_x509.js
@@ -1,9 +1,12 @@
 // Test enabling and disabling the MONGODB-X509 auth mech
 
-TestData.useX509 = false;
 var CLIENT_USER = "CN=client,OU=KernelUser,O=MongoDB,L=New York City,ST=New York,C=US"
 
-var conn = MongoRunner.runMongod({ smallfiles: "", auth: "" });
+var conn = MongoRunner.runMongod({smallfiles: "",
+                                  auth: "",
+                                  sslMode: "requireSSL",
+                                  sslPEMKeyFile: "jstests/libs/server.pem",
+                                  sslCAFile: "jstests/libs/ca.pem"});
 
 // Find out if this build supports the authenticationMechanisms startup parameter.
 // If it does, restart with and without the MONGODB-X509 mechanisms enabled.
diff --git a/jstests/ssl/initial_sync1_x509.js b/jstests/ssl/initial_sync1_x509.js
index 27eb67207ed..f767dba0dde 100644
--- a/jstests/ssl/initial_sync1_x509.js
+++ b/jstests/ssl/initial_sync1_x509.js
@@ -1,6 +1,10 @@
 // Basic tests for cluster authentication using x509.
 
-var common_options = {keyFile : "jstests/libs/key1"};
+var common_options = {keyFile : "jstests/libs/key1",
+                      sslMode : "requireSSL",
+                      sslPEMKeyFile: "jstests/libs/server.pem",
+                      sslCAFile: "jstests/libs/ca.pem",
+                      sslAllowInvalidHostnames: ""};
 
 function runInitialSyncTest() {
     load("jstests/replsets/rslib.js");
diff --git a/jstests/ssl/mixed_mode_repl.js b/jstests/ssl/mixed_mode_repl.js
index 80109a0581c..e5d7297c7e3 100644
--- a/jstests/ssl/mixed_mode_repl.js
+++ b/jstests/ssl/mixed_mode_repl.js
@@ -1,9 +1,6 @@
 // This test is related to mixed_mode_repl_nossl.js in
 // the sslSpecial test set. This test must be run with --use-ssl
 
-// If we are running in use-x509 passthrough mode, turn it off
-// since it is not necessary for this test.
-TestData.useX509 = false;
 load("jstests/ssl/libs/ssl_helpers.js")
 
 // Verify that requireSSL allows ssl connections
diff --git a/jstests/ssl/mixed_mode_sharded.js b/jstests/ssl/mixed_mode_sharded.js
index 08d872939a2..efee241ff0c 100644
--- a/jstests/ssl/mixed_mode_sharded.js
+++ b/jstests/ssl/mixed_mode_sharded.js
@@ -2,10 +2,6 @@
  * This test checks if different mixtures of ssl modes
  * in a sharded cluster can or cannot function
  */
-
-// If we are running in use-x509 passthrough mode, turn it off
-// since it is not necessary for this test.
-TestData.useX509 = false;
 load("jstests/ssl/libs/ssl_helpers.js");
 
 print("=== Testing requireSSL/requireSSL cluster ===");
diff --git a/jstests/ssl/set_parameter_ssl.js b/jstests/ssl/set_parameter_ssl.js
index 19d11b9047f..801d4e15b72 100644
--- a/jstests/ssl/set_parameter_ssl.js
+++ b/jstests/ssl/set_parameter_ssl.js
@@ -1,6 +1,5 @@
 // Test changing the --sslMode and --clusterAuthMode 
 // parameters using setParameter
-TestData.useX509 = false;
 
 var SERVER_CERT = "jstests/libs/server.pem"
 var CA_CERT = "jstests/libs/ca.pem" 
@@ -19,7 +18,7 @@ function testSSLTransition(oldMode, newMode, shouldSucceed) {
                                    "sslMode" : newMode });
 
     assert(res["ok"] == shouldSucceed, tojson(res));
-    stopMongod(port);
+    MongoRunner.stopMongod(port);
 }
 
 function testAuthModeTransition(oldMode, newMode, sslMode, shouldSucceed) {
@@ -36,7 +35,7 @@ function testAuthModeTransition(oldMode, newMode, sslMode, shouldSucceed) {
                                    "clusterAuthMode" : newMode });
 
     assert(res["ok"] == shouldSucceed, tojson(res));
-    stopMongod(port);
+    MongoRunner.stopMongod(port);
 }
 
 testSSLTransition("allowSSL", "invalid", false);
diff --git a/jstests/ssl/sharding_with_x509.js b/jstests/ssl/sharding_with_x509.js
index 1a1e41f6cae..aee7ac0e15f 100644
--- a/jstests/ssl/sharding_with_x509.js
+++ b/jstests/ssl/sharding_with_x509.js
@@ -5,6 +5,7 @@ var x509_options = {sslMode : "requireSSL",
                     sslPEMKeyFile : "jstests/libs/server.pem",
                     sslCAFile: "jstests/libs/ca.pem",
                     sslClusterFile: "jstests/libs/cluster_cert.pem",
+                    sslAllowInvalidHostnames: "",
                     clusterAuthMode: "x509"};
 
 // Start ShardingTest with enableBalancer because ShardingTest attempts to turn
diff --git a/jstests/ssl/ssl_cert_password.js b/jstests/ssl/ssl_cert_password.js
index 1c03f6ed7e0..1c0e271be20 100644
--- a/jstests/ssl/ssl_cert_password.js
+++ b/jstests/ssl/ssl_cert_password.js
@@ -10,13 +10,13 @@ resetDbpath(dbpath);
 mkdir(external_scratch_dir);
 
 // Password is correct
-md = startMongod("--nopreallocj",
-                 "--port", port, 
-                 "--dbpath", dbpath, 
-                 "--sslMode","requireSSL",
-                 "--sslPEMKeyFile", "jstests/libs/password_protected.pem",
-                 "--sslPEMKeyPassword", "qwerty");
-// startMongod connects a Mongo shell, so if we get here, the test is successful.
+var md = MongoRunner.runMongod({nopreallocj: "",
+                                port: port,
+                                dbpath: dbpath,
+                                sslMode: "requireSSL",
+                                sslPEMKeyFile: "jstests/libs/password_protected.pem",
+                                sslPEMKeyPassword: "qwerty"});
+// MongoRunner.runMongod connects a Mongo shell, so if we get here, the test is successful.
 
 
 // Password incorrect; error logged is:
@@ -134,6 +134,6 @@ assert.eq(md5, md5_stored, "hash of stored file does not match the expected valu
 
 if (!_isWindows()) {
     // Stop the server
-    var exitCode = stopMongod(port, 15);
+    var exitCode = MongoRunner.stopMongod(port, 15);
     assert(exitCode == 0);
 }
diff --git a/jstests/ssl/ssl_crl.js b/jstests/ssl/ssl_crl.js
index 0d4bf0f4200..fd83c3979ef 100644
--- a/jstests/ssl/ssl_crl.js
+++ b/jstests/ssl/ssl_crl.js
@@ -5,36 +5,28 @@
 //       crl.pem is a CRL with no revoked certificates.
 
 // This test should allow the user to connect with client.pem certificate.
-ports = allocatePorts(2);
-port1 = ports[0];
-var baseName = "jstests_ssl_ssl_crl";
+var md = MongoRunner.runMongod({sslMode: "requireSSL",
+                                sslPEMKeyFile: "jstests/libs/server.pem",
+                                sslCAFile: "jstests/libs/ca.pem",
+                                sslCRLFile: "jstests/libs/crl.pem"});
 
 
-var md = startMongod("--port", port1, "--dbpath", 
-                     MongoRunner.dataPath + baseName + "1",
-                     "--sslMode", "requireSSL",
-                     "--sslPEMKeyFile", "jstests/libs/server.pem",
-                     "--sslCAFile", "jstests/libs/ca.pem",
-                     "--sslCRLFile", "jstests/libs/crl.pem");
-
-
-var mongo = runMongoProgram("mongo", "--port", port1, "--ssl", "--sslAllowInvalidCertificates",
+var mongo = runMongoProgram("mongo", "--port", md.port, "--ssl", "--sslAllowInvalidCertificates",
                             "--sslPEMKeyFile", "jstests/libs/client.pem",
                             "--eval", ";");
 
 // 0 is the exit code for success
 assert(mongo==0);
 
-port2 = ports[1];
+
 // This test ensures clients cannot connect if the CRL is expired.
-md = startMongod("--port", port2, "--dbpath", MongoRunner.dataPath + baseName + "2",
-                 "--sslMode", "requireSSL",
-                 "--sslPEMKeyFile", "jstests/libs/server.pem",
-                 "--sslCAFile", "jstests/libs/ca.pem",
-                 "--sslCRLFile", "jstests/libs/crl_expired.pem");
+md = MongoRunner.runMongod({sslMode: "requireSSL",
+                            sslPEMKeyFile: "jstests/libs/server.pem",
+                            sslCAFile: "jstests/libs/ca.pem",
+                            sslCRLFile: "jstests/libs/crl_expired.pem"});
 
 
-mongo = runMongoProgram("mongo", "--port", port2, "--ssl", "--sslAllowInvalidCertificates",
+mongo = runMongoProgram("mongo", "--port", md.port, "--ssl", "--sslAllowInvalidCertificates",
                         "--sslPEMKeyFile", "jstests/libs/client.pem",
                         "--eval", ";");
 
diff --git a/jstests/ssl/ssl_crl_revoked.js b/jstests/ssl/ssl_crl_revoked.js
index 53d6671f4f4..97ab29bf46e 100644
--- a/jstests/ssl/ssl_crl_revoked.js
+++ b/jstests/ssl/ssl_crl_revoked.js
@@ -2,18 +2,12 @@
 // Note: crl_client_revoked.pem is a CRL with the client.pem certificate listed as revoked.
 // This test should test that the user cannot connect with client.pem certificate.
 
-port = allocatePorts( 1 )[ 0 ];
-var baseName = "jstests_ssl_ssl_crl_revoked";
+var md = MongoRunner.runMongod({sslMode: "requireSSL",
+                                sslPEMKeyFile: "jstests/libs/server.pem",
+                                sslCAFile: "jstests/libs/ca.pem",
+                                sslCRLFile: "jstests/libs/crl_client_revoked.pem"});
 
-
-var md = startMongod( "--port", port, "--dbpath", MongoRunner.dataPath + baseName,
-                    "--sslMode","requireSSL",
-                    "--sslPEMKeyFile", "jstests/libs/server.pem",
-                    "--sslCAFile", "jstests/libs/ca.pem",
-                    "--sslCRLFile", "jstests/libs/crl_client_revoked.pem");
-
-
-var mongo = runMongoProgram("mongo", "--port", port, "--ssl", "--sslAllowInvalidCertificates",
+var mongo = runMongoProgram("mongo", "--port", md.port, "--ssl", "--sslAllowInvalidCertificates",
                             "--sslPEMKeyFile", "jstests/libs/client_revoked.pem",
                             "--eval", ";");
 
diff --git a/jstests/ssl/ssl_fips.js b/jstests/ssl/ssl_fips.js
index ebcac31e91b..bd1eb36f1cd 100644
--- a/jstests/ssl/ssl_fips.js
+++ b/jstests/ssl/ssl_fips.js
@@ -1,15 +1,16 @@
 // Test mongod start with FIPS mode enabled
 ports = allocatePorts(1);
 port1 = ports[0];
-var baseName = "jstests_ssl_ssl_fips";
+var md = MongoRunner.runMongod({port: port1,
+                                sslMode: "requireSSL",
+                                sslPEMKeyFile: "jstests/libs/server.pem",
+                                sslCAFile: "jstests/libs/ca.pem",
+                                sslFIPSMode: ""});
 
-
-var md = startMongod("--port", port1, "--dbpath",
-                     MongoRunner.dataPath + baseName, "--sslMode", "requireSSL",
-                     "--sslPEMKeyFile", "jstests/libs/server.pem",
-                     "--sslFIPSMode");
-
-var mongo = runMongoProgram("mongo", "--port", port1, "--ssl", "--sslAllowInvalidCertificates",
+var mongo = runMongoProgram("mongo",
+                            "--port", port1,
+                            "--ssl",
+                            "--sslAllowInvalidCertificates",
                             "--sslPEMKeyFile", "jstests/libs/client.pem",
                             "--sslFIPSMode",
                             "--eval", ";");
@@ -22,5 +23,5 @@ if (mongo != 0) {
 }
 else {
     // kill mongod
-    stopMongod(port1);
+    MongoRunner.stopMongod(md);
 }
diff --git a/jstests/ssl/ssl_hostname_validation.js b/jstests/ssl/ssl_hostname_validation.js
index f3bf97bd168..98f99b557e2 100644
--- a/jstests/ssl/ssl_hostname_validation.js
+++ b/jstests/ssl/ssl_hostname_validation.js
@@ -7,12 +7,6 @@ var SAN_CERT = "jstests/libs/localhostnameSAN.pem";
 var CLIENT_CERT = "jstests/libs/client.pem"
 var BAD_SAN_CERT = "jstests/libs/badSAN.pem";
 
-// We want to be able to control all SSL parameters
-// but still need an SSL shell hence the test is placed
-// in the /ssl directory
-TestData.useX509 = false;
-TestData.useSSL = false;
-
 port = allocatePorts(1)[0];
 
 function testCombination(certPath, allowInvalidHost, allowInvalidCert, shouldSucceed) {
@@ -52,7 +46,7 @@ function testCombination(certPath, allowInvalidHost, allowInvalidCert, shouldSuc
         assert.eq(1, mongo, "Connection attempt succeeded when it should fail certPath: " + 
                   certPath);
     }
-    stopMongod(port);
+    MongoRunner.stopMongod(port);
 }
 
 // 1. Test client connections with different server certificates
diff --git a/jstests/ssl/ssl_invalid_server_cert.js b/jstests/ssl/ssl_invalid_server_cert.js
index d179c944fae..6487d0f99b2 100644
--- a/jstests/ssl/ssl_invalid_server_cert.js
+++ b/jstests/ssl/ssl_invalid_server_cert.js
@@ -1,23 +1,18 @@
 // Test SSL Certificate Expiration Monitoring
 // This tests that a mongod with --sslMode requireSSL will not start with an
 // X.509 certificate that is not yet valid or has expired.
-ports = allocatePorts(1);
-port = ports[0];
-var baseName = "jstests_ssl_ssl_invalid_server_cert";
 
 // This test ensures that a mongod will not start with a certificate that is
 // not yet valid. Tested certificate will become valid 06-17-2020.
-var md = startMongod("--port", port, "--dbpath", MongoRunner.dataPath + baseName,
-                     "--sslMode", "requireSSL",
-                     "--sslPEMKeyFile", "jstests/libs/not_yet_valid.pem",
-                     "--sslCAFile", "jstests/libs/ca.pem");
+var md = MongoRunner.runMongod({sslMode: "requireSSL",
+                                sslPEMKeyFile: "jstests/libs/not_yet_valid.pem",
+                                sslCAFile: "jstests/libs/ca.pem"});
 
 assert.eq(null, md, "Possible to start mongod with not yet valid certificate.");
 
 // This test ensures that a mongod with SSL will not start with an expired certificate.
-md = startMongod("--port", port, "--dbpath", MongoRunner.dataPath + baseName,
-                 "--sslMode", "requireSSL",
-                 "--sslPEMKeyFile", "jstests/libs/expired.pem",
-                 "--sslCAFile", "jstests/libs/ca.pem");
+md = MongoRunner.runMongod({sslMode: "requireSSL",
+                            sslPEMKeyFile: "jstests/libs/expired.pem",
+                            sslCAFile: "jstests/libs/ca.pem"});
 
 assert.eq(null, md, "Possible to start mongod with expired certificate");
diff --git a/jstests/ssl/ssl_options.js b/jstests/ssl/ssl_options.js
index f4dcb4d4d47..1881114b482 100644
--- a/jstests/ssl/ssl_options.js
+++ b/jstests/ssl/ssl_options.js
@@ -5,7 +5,8 @@ jsTest.log("Testing censorship of ssl options");
 var mongodConfig = { sslPEMKeyFile : "jstests/libs/password_protected.pem",
                      sslMode : "requireSSL",
                      sslPEMKeyPassword : "qwerty",
-                     sslClusterPassword : "qwerty" };
+                     sslClusterPassword : "qwerty",
+                     sslCAFile: "jstests/libs/ca.pem"};
 var mongodSource = MongoRunner.runMongod(mongodConfig);
 
 var getCmdLineOptsResult = mongodSource.adminCommand("getCmdLineOpts");
diff --git a/jstests/ssl/ssl_weak.js b/jstests/ssl/ssl_weak.js
index 25e2e442549..5a239a6d13c 100644
--- a/jstests/ssl/ssl_weak.js
+++ b/jstests/ssl/ssl_weak.js
@@ -1,27 +1,22 @@
 // Test forcing certificate validation
 // This tests that forcing certification validation will prohibit clients without certificates
 // from connecting.
-ports = allocatePorts( 2 );
-
-var baseName = "jstests_ssl_ssl_weak";
-
 
 // Test that connecting with no client certificate and --sslAllowConnectionsWithoutCertificates
 // (an alias for sslWeakCertificateValidation) connects successfully.
-var md = startMongod( "--port", ports[0], "--dbpath", MongoRunner.dataPath + baseName + "1",
-                      "--sslMode", "requireSSL",
-                      "--sslPEMKeyFile", "jstests/libs/server.pem",
-                      "--sslCAFile", "jstests/libs/ca.pem",
-                      "--sslAllowConnectionsWithoutCertificates");
+var md = MongoRunner.runMongod({sslMode: "requireSSL",
+                                sslPEMKeyFile: "jstests/libs/server.pem",
+                                sslCAFile: "jstests/libs/ca.pem",
+                                sslAllowConnectionsWithoutCertificates: ""});
 
-var mongo = runMongoProgram("mongo", "--port", ports[0], "--ssl", "--sslAllowInvalidCertificates",
+var mongo = runMongoProgram("mongo", "--port", md.port, "--ssl", "--sslAllowInvalidCertificates",
                             "--eval", ";");
 
 // 0 is the exit code for success
 assert(mongo==0);
 
 // Test that connecting with a valid client certificate connects successfully.
-mongo = runMongoProgram("mongo", "--port", ports[0], "--ssl", "--sslAllowInvalidCertificates",
+mongo = runMongoProgram("mongo", "--port", md.port, "--ssl", "--sslAllowInvalidCertificates",
                         "--sslPEMKeyFile", "jstests/libs/client.pem",
                         "--eval", ";");
 
@@ -29,14 +24,13 @@ mongo = runMongoProgram("mongo", "--port", ports[0], "--ssl", "--sslAllowInvalid
 assert(mongo==0);
 
 
-// Test that connecting with no client certificate and no --sslWeakCertificateValidation fails to
-// connect.
-var md2 = startMongod( "--port", ports[1], "--dbpath", MongoRunner.dataPath + baseName + "2",
-                       "--sslMode", "requireSSL",
-                       "--sslPEMKeyFile", "jstests/libs/server.pem",
-                       "--sslCAFile", "jstests/libs/ca.pem");
+// Test that connecting with no client certificate and no --sslAllowConnectionsWithoutCertificates
+// fails to connect.
+var md2 = MongoRunner.runMongod({sslMode: "requireSSL",
+                                sslPEMKeyFile: "jstests/libs/server.pem",
+                                sslCAFile: "jstests/libs/ca.pem"});
 
-mongo = runMongoProgram("mongo", "--port", ports[1], "--ssl", "--sslAllowInvalidCertificates",
+mongo = runMongoProgram("mongo", "--port", md2.port, "--ssl", "--sslAllowInvalidCertificates",
                         "--eval", ";");
 
 // 1 is the exit code for failure
diff --git a/jstests/ssl/ssl_without_ca.js b/jstests/ssl/ssl_without_ca.js
index f70495f3961..87e69eed7e4 100644
--- a/jstests/ssl/ssl_without_ca.js
+++ b/jstests/ssl/ssl_without_ca.js
@@ -1,7 +1,3 @@
-// Must turn these off so we don't have CA file supplied automatically.
-TestData.usex509 = false;
-TestData.useSSL = false;
-
 var SERVER_CERT = "jstests/libs/server.pem";
 var CLIENT_CERT = "jstests/libs/client.pem";
 var CLIENT_USER = "C=US,ST=New York,L=New York City,O=MongoDB,OU=KernelUser,CN=client";
diff --git a/jstests/ssl/upgrade_to_ssl.js b/jstests/ssl/upgrade_to_ssl.js
index e43162246a2..802e99d9eeb 100644
--- a/jstests/ssl/upgrade_to_ssl.js
+++ b/jstests/ssl/upgrade_to_ssl.js
@@ -7,13 +7,14 @@
  * and therefore cannot test modes that do not allow ssl.
  */
 
-// If we are running in use-x509 passthrough mode, turn it off
-// since it is not necessary for this test.
-TestData.useX509 = false;
 load("jstests/ssl/libs/ssl_helpers.js");
 
 // "sslAllowInvalidCertificates" is enabled to avoid hostname conflicts with our testing certs
-opts = {sslMode:"allowSSL", sslPEMKeyFile: SERVER_CERT, sslAllowInvalidCertificates: ""};
+var opts = {sslMode:"allowSSL",
+            sslPEMKeyFile: SERVER_CERT,
+            sslAllowInvalidCertificates: "",
+            sslAllowConnectionsWithoutCertificates: "",
+            sslCAFile: "jstests/libs/ca.pem"};
 var rst = new ReplSetTest({ name: 'sslSet', nodes: 3, nodeOptions : opts });
 rst.startSet();
 rst.initiate();
@@ -23,7 +24,8 @@ rstConn1.getDB("test").a.insert({a:1, str:"TESTTESTTEST"});
 assert.eq(1, rstConn1.getDB("test").a.count(), "Error interacting with replSet");
 
 print("===== UPGRADE allowSSL -> preferSSL =====");
-rst.upgradeSet({sslMode:"preferSSL", sslPEMKeyFile: SERVER_CERT, sslAllowInvalidCertificates: ""});
+opts.sslMode = "preferSSL";
+rst.upgradeSet(opts);
 var rstConn2 = rst.getMaster();
 rstConn2.getDB("test").a.insert({a:2, str:"CHECKCHECK"});
 assert.eq(2, rstConn2.getDB("test").a.count(), "Error interacting with replSet");
@@ -33,7 +35,8 @@ var canConnectNoSSL = runMongoProgram("mongo", "--port", rst.ports[0], "--eval",
 assert.eq(0, canConnectNoSSL, "non-SSL Connection attempt failed when it should succeed");
 
 print("===== UPGRADE preferSSL -> requireSSL =====");
-rst.upgradeSet({sslMode:"requireSSL", sslPEMKeyFile: SERVER_CERT, sslAllowInvalidCertificates: ""});
+opts.sslMode = "requireSSL";
+rst.upgradeSet(opts);
 var rstConn3 = rst.getMaster();
 rstConn3.getDB("test").a.insert({a:3, str:"GREENEGGSANDHAM"});
 assert.eq(3, rstConn3.getDB("test").a.count(), "Error interacting with replSet");
diff --git a/jstests/ssl/upgrade_to_x509_ssl.js b/jstests/ssl/upgrade_to_x509_ssl.js
index c80cbf677aa..a7f8b571d29 100644
--- a/jstests/ssl/upgrade_to_x509_ssl.js
+++ b/jstests/ssl/upgrade_to_x509_ssl.js
@@ -14,9 +14,6 @@ function authAllNodes() {
     }
 };
 
-// If we are running in use-x509 passthrough mode, turn it off
-// since it is not necessary for this test.
-TestData.useX509 = false;
 load("jstests/ssl/libs/ssl_helpers.js");
 
 opts = {sslMode:"allowSSL", sslPEMKeyFile: SERVER_CERT,
diff --git a/jstests/ssl/x509_client.js b/jstests/ssl/x509_client.js
index c2329554e3f..c2c15f7b567 100644
--- a/jstests/ssl/x509_client.js
+++ b/jstests/ssl/x509_client.js
@@ -1,10 +1,9 @@
-// If we are running in use-x509 passthrough mode, turn it off or else the auth 
-// part of this test will not work correctly
-
-TestData.useX509 = false;
-
 // Check if this build supports the authenticationMechanisms startup parameter.
-var conn = MongoRunner.runMongod({ smallfiles: "", auth: "" });
+var conn = MongoRunner.runMongod({smallfiles: "",
+                                  auth: "",
+                                  sslMode: "requireSSL",
+                                  sslPEMKeyFile: "jstests/libs/server.pem",
+                                  sslCAFile: "jstests/libs/ca.pem"});
 conn.getDB('admin').createUser({user: "root", pwd: "pass", roles: ["root"]});
 conn.getDB('admin').auth("root", "pass");
 var cmdOut = conn.getDB('admin').runCommand({getParameter: 1, authenticationMechanisms: 1})
@@ -50,19 +49,16 @@ function authAndTest(mongo) {
 }
 
 print("1. Testing x.509 auth to mongod");
-var mongo = MongoRunner.runMongod({port : port,
-                                sslMode : "requireSSL", 
-                                sslPEMKeyFile : SERVER_CERT, 
-                                sslCAFile : CA_CERT,
-                                auth:""});
+var x509_options = {sslMode : "requireSSL",
+                    sslPEMKeyFile : SERVER_CERT,
+                    sslCAFile : CA_CERT};
+
+var mongo = MongoRunner.runMongod(Object.merge(x509_options, {port: port, auth: ""}));
 
 authAndTest(mongo);
-stopMongod(port);
+MongoRunner.stopMongod(port);
 
 print("2. Testing x.509 auth to mongos");
-var x509_options = {sslMode : "requireSSL",
-                    sslPEMKeyFile : SERVER_CERT,
-                    sslCAFile : CA_CERT};
 
 var st = new ShardingTest({ shards : 1,
                             mongos : 1,
@@ -70,6 +66,7 @@ var st = new ShardingTest({ shards : 1,
                                 extraOptions : {"keyFile" : "jstests/libs/key1"},
                                 configOptions : x509_options,
                                 mongosOptions : x509_options,
+                                shardOptions : x509_options,
                             }});
 
 authAndTest(new Mongo("localhost:" + st.s0.port))
diff --git a/jstests/sslSpecial/set_parameter_nossl.js b/jstests/sslSpecial/set_parameter_nossl.js
index 825ce05fd8e..0b5e72dd4fb 100644
--- a/jstests/sslSpecial/set_parameter_nossl.js
+++ b/jstests/sslSpecial/set_parameter_nossl.js
@@ -17,7 +17,7 @@ function testTransition(newSSLMode, newClusterAuthMode) {
     var res = adminDB.runCommand({ "setParameter" : 1,
                                    "clusterAuthMode" : newClusterAuthMode });
     assert(!res["ok"]);
-    stopMongod(port);
+    MongoRunner.stopMongod(port);
 }
 
 testTransition("allowSSL", "sendKeyFile");
diff --git a/jstests/sslSpecial/ssl_mixedmode.js b/jstests/sslSpecial/ssl_mixedmode.js
index 8ed3c276b3a..701c5ea10d7 100644
--- a/jstests/sslSpecial/ssl_mixedmode.js
+++ b/jstests/sslSpecial/ssl_mixedmode.js
@@ -44,7 +44,7 @@ function testCombination(sslMode, sslShell, shouldSucceed) {
         assert.eq(1, mongo, "Connection attempt succeeded when it should fail sslMode:" + 
                   sslMode + " SSL-shell:" + sslShell);
     }
-    stopMongod(port);
+    MongoRunner.stopMongod(port);
 }
 
 testCombination("disabled", false, true);
diff --git a/src/mongo/shell/mongo.js b/src/mongo/shell/mongo.js
index c5384166677..043c254c29d 100644
--- a/src/mongo/shell/mongo.js
+++ b/src/mongo/shell/mongo.js
@@ -34,7 +34,7 @@ Mongo.prototype.getSlaveOk = function() {
 }
 
 Mongo.prototype.getDB = function( name ){
-    if ((jsTest.options().keyFile || jsTest.options().useX509) && 
+    if ((jsTest.options().keyFile) &&
          ((typeof this.authenticated == 'undefined') || !this.authenticated)) {
         jsTest.authenticate(this)
     }
diff --git a/src/mongo/shell/mongodtest.js b/src/mongo/shell/mongodtest.js
index a8a5e04b5a2..0a05f377d9c 100644
--- a/src/mongo/shell/mongodtest.js
+++ b/src/mongo/shell/mongodtest.js
@@ -34,17 +34,6 @@ startMongodTest = function (port, dirname, restart, extraOptions) {
         options["auth"] = "";
     if(jsTestOptions().keyFile && (!extraOptions || !extraOptions['keyFile']))
         options['keyFile'] = jsTestOptions().keyFile
-    if(jsTestOptions().useSSL) {
-        if (!options["sslMode"])
-            options["sslMode"] = "requireSSL";
-        if (!options["sslPEMKeyFile"])
-            options["sslPEMKeyFile"] = "jstests/libs/server.pem";
-        if (!options["sslCAFile"])
-            options["sslCAFile"] = "jstests/libs/ca.pem";
-        options["sslWeakCertificateValidation"] = "";
-    }
-    if (jsTestOptions().useX509 && !options["clusterAuthMode"])
-        options["clusterAuthMode"] = "x509";
 
     if (extraOptions)
         Object.extend(options , extraOptions);
diff --git a/src/mongo/shell/replsettest.js b/src/mongo/shell/replsettest.js
index f3a923b95b0..3604f099e18 100644
--- a/src/mongo/shell/replsettest.js
+++ b/src/mongo/shell/replsettest.js
@@ -460,8 +460,7 @@ ReplSetTest.prototype.initiate = function( cfg , initCmd , timeout ) {
     this.awaitSecondaryNodes(timeout);
 
     // Setup authentication if running test with authentication
-    if ((jsTestOptions().keyFile || jsTestOptions().useX509) && 
-          cmdKey == 'replSetInitiate') {
+    if ((jsTestOptions().keyFile) && cmdKey == 'replSetInitiate') {
         master = this.getMaster();
         jsTest.authenticateNodes(this.nodes);
     }
@@ -731,7 +730,7 @@ ReplSetTest.prototype.restart = function( n , options, signal, wait ){
     this.stop(n, signal, options);
     started = this.start( n , options , true, wait );
 
-    if (jsTestOptions().keyFile || jsTestOptions().useX509) {
+    if (jsTestOptions().keyFile) {
         if (started.length) {
              // if n was an array of conns, start will return an array of connections
             for (var i = 0; i < started.length; i++) {
diff --git a/src/mongo/shell/servers.js b/src/mongo/shell/servers.js
index 52defda408c..6c487edb20e 100755
--- a/src/mongo/shell/servers.js
+++ b/src/mongo/shell/servers.js
@@ -423,23 +423,7 @@ MongoRunner.mongoOptions = function( opts ){
     // Default for waitForConnect is true
     opts.waitForConnect = (waitForConnect == undefined || waitForConnect == null) ?
         true : waitForConnect;
-    
-    if( jsTestOptions().useSSL ) {
-        if (!opts.sslMode) opts.sslMode = "requireSSL";
-        if (!opts.sslPEMKeyFile) opts.sslPEMKeyFile = "jstests/libs/server.pem";
-        if (!opts.sslCAFile) opts.sslCAFile = "jstests/libs/ca.pem";
-
-        // Needed for jstest/ssl/upgrade_to_ssl.js
-        opts.sslWeakCertificateValidation = "";
-
-        // Needed for jstest/ssl/ssl_hostname_validation.js
-        opts.sslAllowInvalidHostnames = "";
-    }
 
-    if ( jsTestOptions().useX509 && !opts.clusterAuthMode ) {
-        opts.clusterAuthMode = "x509";
-    }
-    
     opts.port = opts.port || MongoRunner.nextOpenPort()
     MongoRunner.usedPortMap[ "" + parseInt( opts.port ) ] = true
     
@@ -493,22 +477,6 @@ MongoRunner.mongodOptions = function( opts ){
         opts.keyFile = jsTestOptions().keyFile
     }
 
-    if( jsTestOptions().useSSL ) {
-        if (!opts.sslMode) opts.sslMode = "requireSSL";
-        if (!opts.sslPEMKeyFile) opts.sslPEMKeyFile = "jstests/libs/server.pem";
-        if (!opts.sslCAFile) opts.sslCAFile = "jstests/libs/ca.pem";
-
-        // Needed for jstest/ssl/upgrade_to_ssl.js
-        opts.sslWeakCertificateValidation = "";
-
-        // Needed for jstest/ssl/ssl_hostname_validation.js
-        opts.sslAllowInvalidHostnames = "";
-    }
-
-    if ( jsTestOptions().useX509 && !opts.clusterAuthMode ) {
-        opts.clusterAuthMode = "x509";
-    }
-
     if( opts.noReplSet ) opts.replSet = null
     if( opts.arbiter ) opts.oplogSize = 1
             
diff --git a/src/mongo/shell/servers_misc.js b/src/mongo/shell/servers_misc.js
index 2a652ce8662..8c338e8285b 100644
--- a/src/mongo/shell/servers_misc.js
+++ b/src/mongo/shell/servers_misc.js
@@ -163,26 +163,6 @@ ReplTest.prototype.getOptions = function( master , extra , putBinaryFirst, norep
         a.push( jsTestOptions().keyFile )
     }
 
-    if( jsTestOptions().useSSL ) {
-        if (!a.contains("--sslMode")) {
-            a.push( "--sslMode" )
-            a.push( "requireSSL" )
-        }
-        if (!a.contains("--sslPEMKeyFile")) {
-            a.push( "--sslPEMKeyFile" )
-            a.push( "jstests/libs/server.pem" )
-        }
-        if (!a.contains("--sslCAFile")) {
-            a.push( "--sslCAFile" )
-            a.push( "jstests/libs/ca.pem" )
-        }
-        a.push( "--sslWeakCertificateValidation" )
-    }
-    if( jsTestOptions().useX509 && !a.contains("--clusterAuthMode")) {
-        a.push( "--clusterAuthMode" )
-        a.push( "x509" )
-    }
-
     if ( !norepl ) {
         if ( master ){
             a.push( "--master" );
@@ -218,7 +198,7 @@ ReplTest.prototype.start = function( master , options , restart, norepl ){
         return conn;
     } else {
         var conn = startMongod.apply(null, o);
-        if (jsTestOptions().keyFile || jsTestOptions().auth || jsTestOptions().useX509) {
+        if (jsTestOptions().keyFile || jsTestOptions().auth) {
             jsTest.authenticate(conn);
         }
         if (!master) {
@@ -331,14 +311,6 @@ function startParallelShell( jsCode, port, noConnect ){
         args.push("--port", port);
     }
 
-    if( jsTestOptions().useSSL ) {
-        args.push( "--ssl" )
-        args.push( "--sslPEMKeyFile" )
-        args.push( "jstests/libs/client.pem" )
-        args.push( "--sslCAFile" )
-        args.push( "jstests/libs/ca.pem" )
-    }
-
     x = startMongoProgramNoConnect.apply(null, args);
     return function(){
         return waitProgram( x );
diff --git a/src/mongo/shell/shardingtest.js b/src/mongo/shell/shardingtest.js
index 2396e6df790..04b1cf3096b 100644
--- a/src/mongo/shell/shardingtest.js
+++ b/src/mongo/shell/shardingtest.js
@@ -424,7 +424,7 @@ ShardingTest = function( testName , numShards , verboseLevel , numMongos , other
         );
     }
 
-    if (jsTestOptions().keyFile || jsTestOptions().useX509) {
+    if (jsTestOptions().keyFile) {
         jsTest.authenticate( this._configConnection );
         jsTest.authenticateNodes( this._configServers );
         jsTest.authenticateNodes( this._mongos );
diff --git a/src/mongo/shell/utils.js b/src/mongo/shell/utils.js
index e61e3c7f4ff..694a5a10709 100644
--- a/src/mongo/shell/utils.js
+++ b/src/mongo/shell/utils.js
@@ -157,9 +157,7 @@ jsTestOptions = function(){
                               authPassword : TestData.keyFileData,
                               authMechanism : TestData.authMechanism,
                               adminUser : TestData.adminUser || "admin",
-                              adminPassword : TestData.adminPassword || "password",
-                              useSSL : TestData.useSSL,
-                              useX509 : TestData.useX509});
+                              adminPassword : TestData.adminPassword || "password"});
     }
     return _jsTestOptions;
 }
@@ -195,7 +193,7 @@ jsTest.randomize = function( seed ) {
 }
 
 jsTest.authenticate = function(conn) {
-    if (!jsTest.options().auth && !jsTest.options().keyFile && !jsTest.options().useX509) {
+    if (!jsTest.options().auth && !jsTest.options().keyFile) {
         conn.authenticated = true;
         return true;
     }