SYNOPSIS

#include <mongoc.h>

mongoc_stream_t * unix_stream;
mongoc_stream_t * tls_stream;
mongoc_ssl_opt_t opt = { 0 };

opt.pem_file = "path/to/pk.pem";
opt.pem_pwd = "super secret password";
opt.ca_file = "path/to/ca.cert";

unix_stream = mongoc_stram_unix_new(fd);
ssl_stream = mongoc_stream_tls_new(sock_stream, &opt, is_client);

DESCRIPTION

mongoc_ssl provides a wrapper on top of OpenSSL. Specifically, it provides:

  • Sensible defaults for an internal SSL_CTX in terms of ciphers and versions

  • Loading of various artifacts in a declerative rather than imperative manner. I.e. certificate chains, private keys, crl’s, etc.

  • Hooks for the mongoc_stream_tls abstraction to manage handshakes and cert verification.

OPTIONS

typedef struct mongoc_ssl_opt
{
   const char *pem_file;
   const char *pem_pwd;
   const char *ca_file;
   const char *ca_dir;
   const char *crl_file;
   bool weak_cert_validation;
} mongoc_ssl_opt_t;
pem_file

A PEM file containing the private key and certificate chain

pem_pwd

The pass phrase needed to access the passed pem_file. You only need to pass this if the associated pem_file requires a pass phrase.

ca_file

A certificate authority file. I.e. any needed root certificates that may be needed to authenticate that returned by a peer.

ca_dir

A directory as that laid out by c_rehash. See SSL_CTX_load_verify_locations(3) for more on the layout.

crl_file

A certificate revocation list file

weak_cert_validation

If the library should bother performing certificate verification on the cert returned by the peer.

SEE ALSO

AUTHORS

This page was written by MongoDB Inc.