PYTHON-5040: Allow cert overrides for all CSFLE KMS servers and add --tls-allow-invalid-certificates#791
Merged
blink1073 merged 9 commits intoJun 11, 2026
Conversation
…csfle scripts Adds CSFLE_TLS_EXPIRED_FILE and CSFLE_TLS_WRONG_HOST_FILE env vars following the same override pattern as CSFLE_TLS_CA_FILE and friends.
6 tasks
Add TLS_DISABLE_CERTIFICATE_REVOCATION_CHECK env var support to _get_cluster_options so callers can inject --tlsDisableCertificateRevocationCheck into mongod args without modifying orchestration config files. This avoids CSSMERR_TP_CERT_SUSPENDED on macOS where MongoDB Enterprise enforces OCSP with kSecRevocationRequirePositiveResponse.
…ivers-orchestration Add a standard --tls-disable-certificate-revocation-check flag (also settable via TLS_DISABLE_CERTIFICATE_REVOCATION_CHECK env var) that injects tlsDisableCertificateRevocationCheck into sslParams. Handles both the mongodb-runner path (via the existing sslParams loop) and the mongo-orchestration path (via the HTTP config payload). Avoids CSSMERR_TP_CERT_SUSPENDED on macOS where MongoDB Enterprise enforces OCSP with kSecRevocationRequirePositiveResponse.
--tlsDisableCertificateRevocationCheck is not a valid direct mongod CLI flag; it must be passed as --setParameter tlsDisableCertificateRevocationCheck=1. Special-case it in the sslParams processing loop.
tlsDisableCertificateRevocationCheck does not exist in MongoDB 8.x as either a direct CLI flag or a setParameter. Use --tlsAllowInvalidCertificates instead, which is a valid mongod CLI flag that skips certificate verification for inter-node TLS connections, bypassing macOS OCSP enforcement (CSSMERR_TP_CERT_SUSPENDED) without affecting Python client cert verification. Rename the drivers-orchestration flag to --tls-allow-invalid-certificates to reflect the underlying mongod parameter.
blink1073
changed the title
blink1073
changed the title
eramongodb
requested changes
Jun 11, 2026
Co-authored-by: Ezra Chung <88335979+eramongodb@users.noreply.github.com>
eramongodb
approved these changes
Jun 11, 2026
eramongodb
left a comment
eramongodb
left a comment
Contributor
There was a problem hiding this comment.
Another minor doc wording suggestion; otherwise, LGTM.
Co-authored-by: Ezra Chung <88335979+eramongodb@users.noreply.github.com>
Member
Author
|
Thanks @eramongodb! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PYTHON-5040
Tested with mongodb/mongo-python-driver#2846
Summary
Allows drivers to supply custom TLS certificates for all CSFLE KMS mock servers, enabling drivers that maintain their own test certs to point the mock servers at them. Also adds a
--tls-allow-invalid-certificatesflag todrivers_orchestration.pyfor macOS, where Apple SecTrust performs OCSP checks on test certificates.Changes in this PR
--tls-allow-invalid-certificatesflag todrivers_orchestration.pyfor macOS, where Apple SecTrust performs OCSP checks.Test Plan
Callers can export the affected environment variables before running
setup-secrets.shto point the mock servers at custom certificates.Checklist
Checklist for Author
Checklist for Reviewer