Enable TLS on a Connection在连接上启用TLS

Overview概述

In this guide, you can learn how to connect to MongoDB instances with the TLS security protocol.在本指南中，您可以学习如何使用TLS安全协议连接到MongoDB实例。

To configure your connection to use TLS, enable the TLS option and provide your certificates for validation.要将连接配置为使用TLS，请启用TLS选项并提供证书以供验证。

Enable TLS启用TLS

You can enable TLS on a connection to your MongoDB instance in the following ways:您可以通过以下方式在与MongoDB实例的连接上启用TLS：

• Setting the tls option to true in your MongoClientOptions object
• Setting the tls option to true in your connection string在连接字符串中将tls选项设置为true

const client = new MongoClient(uri, { tls: true });

const uri = "mongodb://<hostname>:<port>?tls=true";
const client = new MongoClient(uri, myClientSettings);

import { MongoClient } from 'mongodb';
import crypto from 'crypto';

const client = new MongoClient("mongodb+srv://...", {
   secureContext: {
      secureOptions: crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT
   }
});

In addition to the tls client option, the driver provides more options to configure TLS on your connection. For testing purposes, you can set the tlsAllowInvalidHostnames, tlsAllowInvalidCertificates, and tlsInsecure client options.除了tls客户端选项外，驱动程序还提供了更多选项来配置连接上的tls。出于测试目的，您可以设置tlsAllowInvalidHostnames、tlsAllowValidCertificates和tlsInsecure客户端选项。

Setting the tlsAllowInvalidHostnames option to true disables hostname verification, and setting the tlsAllowInvalidCertificates to true disables certificate validation. Setting the tlsInsecure option to true disables both certificate and hostname validation.将tlsAllowInvalidHostnames选项设置为true会禁用主机名验证，将tlsAlowInvalidCertificates设置为true则会禁用证书验证。将tlsInsecure选项设置为true将禁用证书和主机名验证。

For a full list of client options, see Specify Connection Options.有关客户端选项的完整列表，请参阅指定连接选项。

Configure Certificates配置证书

To successfully initiate a TLS request, an application must prove its identity by referencing cryptographic certificates. To connect to MongoDB with TLS, your certificates must be stored as PEM files.为了成功发起TLS请求，应用程序必须通过引用加密证书来证明其身份。要使用TLS连接到MongoDB，您的证书必须存储为PEM文件。

The following list describes the components required to establish a connection with TLS:以下列表描述了建立TLS连接所需的组件：

Reference Certificates in a Client客户端中的参考证书

You must reference your certificates in your MongoClientOptions object so that the server can validate them before the client connects. You can reference your certificates in the following ways:您必须在MongoClientOptions对象中引用您的证书，以便服务器可以在客户端连接之前验证它们。您可以通过以下方式引用您的证书：

• Create a SecureContext object to store certificates (Recommended)创建SecureContext对象以存储证书（推荐）
• Provide filepath strings that point to your certificates提供指向证书的文件路径字符串
• Create Buffer objects to store certificates创建Buffer对象以存储证书

// Create a SecureContext object创建SecureContext对象
const secureContext = tls.createSecureContext({
  ca: fs.readFileSync(`<path to CA certificate>`),
  cert: fs.readFileSync(`<path to public client certificate>`),
  key: fs.readFileSync(`<path to private client key>`),
});

// Pass the SecureContext as a client option将SecureContext作为客户端选项传递
const client = new MongoClient(uri, { tls: true, secureContext });

// Pass filepaths as client options将文件路径作为客户端选项传递
const client = new MongoClient(uri, {
  tls: true,
  tlsCAFile: `<path to CA certificate>`,
  tlsCertificateKeyFile: `<path to private client key>`,
});

// Read file contents读取文件内容
const ca = fs.readFileSync(`<path to CA certificate>`);
const cert = fs.readFileSync(`<path to public client certificate>`);
const key = fs.readFileSync(`<path to private client key>`);

// Pass Buffers as client options将缓冲区作为客户端选项传递
const client = new MongoClient(uri, { tls: true, ca, cert, key });

SecureContext Example安全上下文示例

This example shows how to create a SecureContext object and a MongoClient instance that includes TLS options. The example connects to MongoDB and executes a find query:此示例显示了如何创建SecureContext对象和包含TLS选项的MongoClient实例。该示例连接到MongoDB并执行查找查询：

import { MongoClient } from "mongodb";
import * as fs from "fs";
import * as tls from "tls";

// Replace the uri string with your connection string.将uri字符串替换为连接字符串。
const uri = "<connection uri>";

// Replace the filepaths with your certificate filepaths.将文件路径替换为证书文件路径。
const secureContext = tls.createSecureContext({
  ca: fs.readFileSync(`<path to CA certificate>`),
  cert: fs.readFileSync(`<path to public client certificate>`),
  key: fs.readFileSync(`<path to private client key>`),
});

// Create a client with the secureContext option使用secureContext选项创建客户端
const client = new MongoClient(uri, { tls: true, secureContext });

async function run() {
  try {
    const db = client.db("myDB");
    const myColl = db.collection("myColl");
    const doc = await myColl.findOne({});
    console.log(doc);
  } finally {
    await client.close();
  }
}
run().catch(console.dir);

Additional Information附加信息

For more information about enabling TLS on a connection, see the following Server manual documentation:有关在连接上启用TLS的更多信息，请参阅以下服务器手册文档：

• TLS/SSL (Transport Encryption)
• TLS/SSL Configuration for Clients