Enable TLS on a Connection在连接上启用TLS

Overview概述

In this guide, you can learn how to connect to MongoDB instances with the TLS security protocol.在本指南中，您可以了解如何使用TLS安全协议连接到MongoDB实例。

To configure your connection to use TLS, enable the TLS option and provide your certificates for validation.若要将连接配置为使用TLS，请启用TLS选项并提供证书以进行验证。

Enable TLS启用TLS

You can enable TLS on a connection to your MongoDB instance in the following ways:您可以通过以下方式在与MongoDB实例的连接上启用TLS：

• Setting the tls option to true in your MongoClientOptions object在MongoClientOptions对象中将tls选项设置为true
• Setting the tls option to true in your connection string在连接字符串中将tls选项设置为true

In addition to the tls client option, the driver provides additional options to configure TLS on your connection. 除了tls客户端选项外，驱动程序还提供了其他选项，用于在连接上配置tls。For testing purposes, you can set the tlsAllowInvalidHostnames, tlsAllowInvalidCertificates, and tlsInsecure client options.出于测试目的，可以设置tlsAllowInvalidHostnames、tlsAllowInvalidCertificates和tlsInsecure客户端选项。

Setting the tlsAllowInvalidHostnames option to true disables hostname verification, and setting the tlsAllowInvalidCertificates to true disables certificate validation. 将tlsAllowInvalidHostnames选项设置为true将禁用主机名验证，将tlsAlowInvalidCertificates设置为true则禁用证书验证。Setting the tlsInsecure option to true disables both certificate and hostname validation.将tlsInsecure选项设置为true将禁用证书和主机名验证。

For a full list of client options, see Connection Options.有关客户端选项的完整列表，请参阅连接选项。

Configure Certificates配置证书

To successfully initiate a TLS request, an application must prove its identity by referencing cryptographic certificates. 若要成功启动TLS请求，应用程序必须通过引用加密证书来证明其身份。To connect to MongoDB with TLS, your certificates must be stored as PEM files.要使用TLS连接到MongoDB，您的证书必须存储为PEM文件。

The following list describes the components that you need to establish a connection with TLS:以下列表描述了建立TLS连接所需的组件：

Reference Certificates in a Client客户端中的参考证书

You must reference your certificates in your MongoClientOptions object so that the server can validate them before the client connects. 您必须在MongoClientOptions对象中引用证书，以便服务器能够在客户端连接之前对其进行验证。You can reference your certificates in the following ways:您可以通过以下方式引用证书：

• Create a SecureContext object to store certificates (Recommended)创建SecureContext对象以存储证书（推荐）
• Provide filepath strings that point to your certificates提供指向证书的文件路径字符串
• Create Buffer objects to store certificates创建Buffer对象以存储证书

// Create a SecureContext object创建SecureContext对象
const secureContext = tls.createSecureContext({
  ca: fs.readFileSync(`<path to CA certificate>`),
  cert: fs.readFileSync(`<path to public client certificate>`),
  key: fs.readFileSync(`<path to private client key>`),
});

// Pass the SecureContext as a client option将SecureContext作为客户端选项传递
const client = new MongoClient(uri, { tls: true, secureContext });

// Pass filepaths as client options将文件路径作为客户端选项传递
const client = new MongoClient(uri, {
  tls: true,
  tlsCAFile: `<path to CA certificate>`,
  tlsCertificateFile: `<path to public client certificate>`,
  tlsCertificateKeyFile: `<path to private client key>`,
});

// Read file contents读取文件内容
const ca = fs.readFileSync(`<path to CA certificate>`);
const cert = fs.readFileSync(`<path to public client certificate>`);
const key = fs.readFileSync(`<path to private client key>`);

// Pass Buffers as client options将缓冲区作为客户端选项传递
const client = new MongoClient(uri, { tls: true, ca, cert, key });

SecureContext ExampleSecureContext示例

This example shows how to create a SecureContext object and a MongoClient instance that includes TLS options. 这个例子展示了如何创建一个SecureContext对象和一个包含TLS选项的MongoClient实例。The example connects to MongoDB and executes a find query:该示例连接到MongoDB并执行查找查询：

import { MongoClient } from "mongodb";
import * as fs from "fs";
import * as tls from "tls";

// Replace the uri string with your connection string.将uri字符串替换为连接字符串。
const uri = "<connection uri>";

// Replace the filepaths with your certificate filepaths.将文件路径替换为证书文件路径。
const secureContext = tls.createSecureContext({
  ca: fs.readFileSync(`<path to CA certificate>`),
  cert: fs.readFileSync(`<path to public client certificate>`),
  key: fs.readFileSync(`<path to private client key>`),
});

// Create a client with the secureContext option使用secureContext选项创建客户端
const client = new MongoClient(uri, { tls: true, secureContext });

async function run() {
  try {
    const db = client.db("myDB");
    const myColl = db.collection("myColl");
    const doc = await myColl.findOne({});
    console.log(doc);
  } finally {
    await client.close();
  }
}
run().catch(console.dir);

Additional Information附加信息

For more information about enabling TLS on a connection, see the following Server manual documentation:有关在连接上启用TLS的详细信息，请参阅以下服务器手册文档：

• TLS/SSL (Transport Encryption)（传输加密）
• TLS/SSL Configuration for Clients客户端配置