diff options
| author | Varun Ravichandran <varun.ravichandran@mongodb.com> | 2023-04-14 16:48:36 +0000 |
|---|---|---|
| committer | Evergreen Agent <no-reply@evergreen.mongodb.com> | 2023-04-20 17:33:58 +0000 |
| commit | c8bf6ed05ae8d8954760bf47703703ddd34f8421 (patch) | |
| tree | ed45259d47c279b92987ce2524c0a677ac4f017e /src/mongo/util | |
| parent | 8a196ea04f9b5ca08fbf266c94bb4596f478ea78 (diff) | |
| download | mongo-c8bf6ed05ae8d8954760bf47703703ddd34f8421.tar.gz | |
SERVER-69855: Document tlsClusterAuthX509 options and overrides in arch guides
Diffstat (limited to 'src/mongo/util')
| -rw-r--r-- | src/mongo/util/net/README.md | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/mongo/util/net/README.md b/src/mongo/util/net/README.md index fbc7daebb9b..96ea7537241 100644 --- a/src/mongo/util/net/README.md +++ b/src/mongo/util/net/README.md @@ -259,6 +259,9 @@ authenticate to them. If `net.tls.clusterFile` is not specified, then [`net.tls.certificateKeyFile`](https://docs.mongodb.com/manual/reference/configuration-options/#net.tls.certificateKeyFile) will be used. -Member and client certificates are basically the same, content-wise. Nodes will only consider a peer certificate to be a -member certificate if the _Organization (O)_, _Organizational Unit (OU)_, and _Domain Component (DC)_ that might be -contained in the certificate's _Subject Name_ match those contained in _its own_ subject name. +By default, nodes will only consider a peer certificate to be a member certificate if the +_Organization (O)_, _Organizational Unit (OU)_, and _Domain Component (DC)_ that might be contained +in the certificate's _Subject Name_ match those contained in _its own_ subject name. This behavior +can be customized to check for different attributes via `net.tls.clusterAuthX509.attributes` or +`net.tls.clusterAuthX509.extensionValue`. See the [`auth`](../../db/auth/README.md) documentation +for more information about X.509 intracluster auth. |