From 84e686224303183b50b3d4f647518d711bd60413 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Thu, 4 Jun 2026 19:28:13 -0500 Subject: [PATCH 1/9] PYTHON-5040 Allow wrong-host.pem and expired.pem to be overridden in csfle scripts Adds CSFLE_TLS_EXPIRED_FILE and CSFLE_TLS_WRONG_HOST_FILE env vars following the same override pattern as CSFLE_TLS_CA_FILE and friends. --- .evergreen/csfle/setup-secrets.sh | 4 ++++ .evergreen/csfle/setup_secrets.py | 2 ++ .evergreen/csfle/start-servers.sh | 4 ++-- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.evergreen/csfle/setup-secrets.sh b/.evergreen/csfle/setup-secrets.sh index 5673be63a..74554bd0c 100755 --- a/.evergreen/csfle/setup-secrets.sh +++ b/.evergreen/csfle/setup-secrets.sh @@ -15,11 +15,15 @@ PARENT_DIR=$(dirname $SCRIPT_DIR) export CSFLE_TLS_CA_FILE=${CSFLE_TLS_CA_FILE:-"$PARENT_DIR/x509gen/ca.pem"} export CSFLE_TLS_CERT_FILE=${CSFLE_TLS_CERT_FILE:-"$PARENT_DIR/x509gen/server.pem"} export CSFLE_TLS_CLIENT_CERT_FILE=${CSFLE_TLS_CLIENT_CERT_FILE:-"$PARENT_DIR/x509gen/client.pem"} +export CSFLE_TLS_EXPIRED_FILE=${CSFLE_TLS_EXPIRED_FILE:-"$PARENT_DIR/x509gen/expired.pem"} +export CSFLE_TLS_WRONG_HOST_FILE=${CSFLE_TLS_WRONG_HOST_FILE:-"$PARENT_DIR/x509gen/wrong-host.pem"} if [[ "${OSTYPE:?}" == cygwin ]]; then CSFLE_TLS_CA_FILE=$(cygpath -m $CSFLE_TLS_CA_FILE) CSFLE_TLS_CERT_FILE=$(cygpath -m $CSFLE_TLS_CERT_FILE) CSFLE_TLS_CLIENT_CERT_FILE=$(cygpath -m $CSFLE_TLS_CLIENT_CERT_FILE) + CSFLE_TLS_EXPIRED_FILE=$(cygpath -m $CSFLE_TLS_EXPIRED_FILE) + CSFLE_TLS_WRONG_HOST_FILE=$(cygpath -m $CSFLE_TLS_WRONG_HOST_FILE) fi pushd $SCRIPT_DIR diff --git a/.evergreen/csfle/setup_secrets.py b/.evergreen/csfle/setup_secrets.py index 74d757321..168f86056 100755 --- a/.evergreen/csfle/setup_secrets.py +++ b/.evergreen/csfle/setup_secrets.py @@ -144,6 +144,8 @@ def b64url(data: bytes) -> str: "CSFLE_TLS_CA_FILE", "CSFLE_TLS_CERT_FILE", "CSFLE_TLS_CLIENT_CERT_FILE", + "CSFLE_TLS_EXPIRED_FILE", + "CSFLE_TLS_WRONG_HOST_FILE", ]: fid.write(f'\nexport {key}="{os.environ[key]}"'.encode()) fid.write(b"\n") diff --git a/.evergreen/csfle/start-servers.sh b/.evergreen/csfle/start-servers.sh index 379ba6b0f..f85d40fce 100755 --- a/.evergreen/csfle/start-servers.sh +++ b/.evergreen/csfle/start-servers.sh @@ -49,7 +49,7 @@ echo "Starting KMIP Server...done." echo "Starting HTTP Server 1..." -$COMMAND kms_http_server.py --ca_file $CSFLE_TLS_CA_FILE --cert_file ../x509gen/expired.pem --port 9000 > http1.log 2>&1 & +$COMMAND kms_http_server.py --ca_file $CSFLE_TLS_CA_FILE --cert_file $CSFLE_TLS_EXPIRED_FILE --port 9000 > http1.log 2>&1 & echo "$!" >> kmip_pids.pid sleep 1 cat http1.log @@ -57,7 +57,7 @@ echo "Starting HTTP Server 1...done." echo "Starting HTTP Server 2..." -$COMMAND kms_http_server.py --ca_file $CSFLE_TLS_CA_FILE --cert_file ../x509gen/wrong-host.pem --port 9001 > http2.log 2>&1 & +$COMMAND kms_http_server.py --ca_file $CSFLE_TLS_CA_FILE --cert_file $CSFLE_TLS_WRONG_HOST_FILE --port 9001 > http2.log 2>&1 & echo "$!" >> kmip_pids.pid sleep 1 cat http2.log From eab9fc4fc74a523e5b24e691752aaf2c8c4f2eb3 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Thu, 4 Jun 2026 19:48:11 -0500 Subject: [PATCH 2/9] Allow CSFLE_TLS_CERT_FILE/CSFLE_TLS_CA_FILE to override failpoint server certs --- .evergreen/csfle/kms_failpoint_server.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.evergreen/csfle/kms_failpoint_server.py b/.evergreen/csfle/kms_failpoint_server.py index 76ecaaa7a..b798b4883 100644 --- a/.evergreen/csfle/kms_failpoint_server.py +++ b/.evergreen/csfle/kms_failpoint_server.py @@ -41,8 +41,10 @@ def __init__(self, server_address, Handler, use_tls=True): if use_tls: server_dir = os.path.dirname(__file__) - cert_file = os.path.join(server_dir, "..", "x509gen", "server.pem") - ca_file = os.path.join(server_dir, "..", "x509gen", "ca.pem") + default_cert = os.path.join(server_dir, "..", "x509gen", "server.pem") + default_ca = os.path.join(server_dir, "..", "x509gen", "ca.pem") + cert_file = os.environ.get("CSFLE_TLS_CERT_FILE", default_cert) + ca_file = os.environ.get("CSFLE_TLS_CA_FILE", default_ca) context = ssl.SSLContext(ssl.PROTOCOL_TLS) context.load_verify_locations(ca_file) From d22307cbbed50804cbf148becf258e5c715b370c Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Tue, 9 Jun 2026 13:41:32 -0500 Subject: [PATCH 3/9] PYTHON-5040 Disable TLS revocation check on macOS via env var Add TLS_DISABLE_CERTIFICATE_REVOCATION_CHECK env var support to _get_cluster_options so callers can inject --tlsDisableCertificateRevocationCheck into mongod args without modifying orchestration config files. This avoids CSSMERR_TP_CERT_SUSPENDED on macOS where MongoDB Enterprise enforces OCSP with kSecRevocationRequirePositiveResponse. --- .evergreen/orchestration/mongodb_runner.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.evergreen/orchestration/mongodb_runner.py b/.evergreen/orchestration/mongodb_runner.py index ba54bb03b..9b66eb6fa 100644 --- a/.evergreen/orchestration/mongodb_runner.py +++ b/.evergreen/orchestration/mongodb_runner.py @@ -299,6 +299,8 @@ def _get_cluster_options(input: dict, opts: Any, static=False) -> Dict[str, Any] if key == "sslCAFile": key = "tlsCAFile" # noqa: PLW2901 _append_arg(args, key, value) + if os.environ.get("TLS_DISABLE_CERTIFICATE_REVOCATION_CHECK"): + _append_arg(args, "tlsDisableCertificateRevocationCheck", True) if input.get("login"): users.append( From 9ee819ac0dcefb27a25f15b69b220182718f7081 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Tue, 9 Jun 2026 14:24:35 -0500 Subject: [PATCH 4/9] PYTHON-5040 Add --tls-disable-certificate-revocation-check flag to drivers-orchestration Add a standard --tls-disable-certificate-revocation-check flag (also settable via TLS_DISABLE_CERTIFICATE_REVOCATION_CHECK env var) that injects tlsDisableCertificateRevocationCheck into sslParams. Handles both the mongodb-runner path (via the existing sslParams loop) and the mongo-orchestration path (via the HTTP config payload). Avoids CSSMERR_TP_CERT_SUSPENDED on macOS where MongoDB Enterprise enforces OCSP with kSecRevocationRequirePositiveResponse. --- .evergreen/orchestration/drivers_orchestration.py | 8 ++++++++ .evergreen/orchestration/mongodb_runner.py | 3 --- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.evergreen/orchestration/drivers_orchestration.py b/.evergreen/orchestration/drivers_orchestration.py index b1e877910..3f28ce6e6 100644 --- a/.evergreen/orchestration/drivers_orchestration.py +++ b/.evergreen/orchestration/drivers_orchestration.py @@ -142,6 +142,11 @@ def get_options(): "--tls-ca-file", help="A .pem file that contains the root certificate chain for the server", ) + other_group.add_argument( + "--tls-disable-certificate-revocation-check", + action="store_true", + help="Whether to disable TLS certificate revocation checking (avoids OCSP failures on macOS)", + ) other_group.add_argument( "--arch", help="the architecture. if unspecified, the arch will be inferred.", @@ -366,6 +371,9 @@ def get_orchestration_data(opts): ) data["requireApiVersion"] = "1" + if opts.tls_disable_certificate_revocation_check and "sslParams" in data: + data["sslParams"]["tlsDisableCertificateRevocationCheck"] = True + # If running on Docker, update the orchestration file to be docker-friendly. if os.environ.get("DOCKER_RUNNING"): handle_docker_config(data) diff --git a/.evergreen/orchestration/mongodb_runner.py b/.evergreen/orchestration/mongodb_runner.py index 9b66eb6fa..85a618cf3 100644 --- a/.evergreen/orchestration/mongodb_runner.py +++ b/.evergreen/orchestration/mongodb_runner.py @@ -299,9 +299,6 @@ def _get_cluster_options(input: dict, opts: Any, static=False) -> Dict[str, Any] if key == "sslCAFile": key = "tlsCAFile" # noqa: PLW2901 _append_arg(args, key, value) - if os.environ.get("TLS_DISABLE_CERTIFICATE_REVOCATION_CHECK"): - _append_arg(args, "tlsDisableCertificateRevocationCheck", True) - if input.get("login"): users.append( { From 43d0869655f5d1f450f980724bb555ed87220b45 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Tue, 9 Jun 2026 14:35:05 -0500 Subject: [PATCH 5/9] PYTHON-5040 Use setParameter for tlsDisableCertificateRevocationCheck --tlsDisableCertificateRevocationCheck is not a valid direct mongod CLI flag; it must be passed as --setParameter tlsDisableCertificateRevocationCheck=1. Special-case it in the sslParams processing loop. --- .evergreen/orchestration/mongodb_runner.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.evergreen/orchestration/mongodb_runner.py b/.evergreen/orchestration/mongodb_runner.py index 85a618cf3..aca1cb005 100644 --- a/.evergreen/orchestration/mongodb_runner.py +++ b/.evergreen/orchestration/mongodb_runner.py @@ -296,8 +296,14 @@ def _get_cluster_options(input: dict, opts: Any, static=False) -> Dict[str, Any] for key, value in input["sslParams"].items(): if key == "sslPEMKeyFile": key = "tlsCertificateKeyFile" # noqa: PLW2901 - if key == "sslCAFile": + elif key == "sslCAFile": key = "tlsCAFile" # noqa: PLW2901 + elif key == "tlsDisableCertificateRevocationCheck": + if value: + args.extend( + ["--setParameter", "tlsDisableCertificateRevocationCheck=1"] + ) + continue _append_arg(args, key, value) if input.get("login"): users.append( From 9e363cded024c1d25d9df8ca6f3cf1235de06b9c Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Tue, 9 Jun 2026 14:49:03 -0500 Subject: [PATCH 6/9] PYTHON-5040 Inject --tlsAllowInvalidCertificates to bypass OCSP on macOS tlsDisableCertificateRevocationCheck does not exist in MongoDB 8.x as either a direct CLI flag or a setParameter. Use --tlsAllowInvalidCertificates instead, which is a valid mongod CLI flag that skips certificate verification for inter-node TLS connections, bypassing macOS OCSP enforcement (CSSMERR_TP_CERT_SUSPENDED) without affecting Python client cert verification. Rename the drivers-orchestration flag to --tls-allow-invalid-certificates to reflect the underlying mongod parameter. --- .evergreen/orchestration/drivers_orchestration.py | 9 +++++---- .evergreen/orchestration/mongodb_runner.py | 6 ------ 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/.evergreen/orchestration/drivers_orchestration.py b/.evergreen/orchestration/drivers_orchestration.py index 3f28ce6e6..fada6d63c 100644 --- a/.evergreen/orchestration/drivers_orchestration.py +++ b/.evergreen/orchestration/drivers_orchestration.py @@ -143,9 +143,10 @@ def get_options(): help="A .pem file that contains the root certificate chain for the server", ) other_group.add_argument( - "--tls-disable-certificate-revocation-check", + "--tls-allow-invalid-certificates", action="store_true", - help="Whether to disable TLS certificate revocation checking (avoids OCSP failures on macOS)", + help="Whether to pass --tlsAllowInvalidCertificates to mongod, bypassing " + "certificate revocation (OCSP) enforcement on macOS", ) other_group.add_argument( "--arch", @@ -371,8 +372,8 @@ def get_orchestration_data(opts): ) data["requireApiVersion"] = "1" - if opts.tls_disable_certificate_revocation_check and "sslParams" in data: - data["sslParams"]["tlsDisableCertificateRevocationCheck"] = True + if opts.tls_allow_invalid_certificates and "sslParams" in data: + data["sslParams"]["tlsAllowInvalidCertificates"] = True # If running on Docker, update the orchestration file to be docker-friendly. if os.environ.get("DOCKER_RUNNING"): diff --git a/.evergreen/orchestration/mongodb_runner.py b/.evergreen/orchestration/mongodb_runner.py index aca1cb005..0af7acd72 100644 --- a/.evergreen/orchestration/mongodb_runner.py +++ b/.evergreen/orchestration/mongodb_runner.py @@ -298,12 +298,6 @@ def _get_cluster_options(input: dict, opts: Any, static=False) -> Dict[str, Any] key = "tlsCertificateKeyFile" # noqa: PLW2901 elif key == "sslCAFile": key = "tlsCAFile" # noqa: PLW2901 - elif key == "tlsDisableCertificateRevocationCheck": - if value: - args.extend( - ["--setParameter", "tlsDisableCertificateRevocationCheck=1"] - ) - continue _append_arg(args, key, value) if input.get("login"): users.append( From 9c08f62ff986231b390a22e721419e7571f2ef25 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Thu, 11 Jun 2026 12:32:42 -0500 Subject: [PATCH 7/9] Update .evergreen/orchestration/drivers_orchestration.py Co-authored-by: Ezra Chung <88335979+eramongodb@users.noreply.github.com> --- .evergreen/orchestration/drivers_orchestration.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.evergreen/orchestration/drivers_orchestration.py b/.evergreen/orchestration/drivers_orchestration.py index fada6d63c..004ae6346 100644 --- a/.evergreen/orchestration/drivers_orchestration.py +++ b/.evergreen/orchestration/drivers_orchestration.py @@ -146,7 +146,7 @@ def get_options(): "--tls-allow-invalid-certificates", action="store_true", help="Whether to pass --tlsAllowInvalidCertificates to mongod, bypassing " - "certificate revocation (OCSP) enforcement on macOS", + "certificate revocation (OCSP) enforcement", ) other_group.add_argument( "--arch", From a1311ebfeea850ea9ca598dac7cf3a8f0fb1897f Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Thu, 11 Jun 2026 12:34:34 -0500 Subject: [PATCH 8/9] Raise error when --tls-allow-invalid-certificates set without TLS configured --- .evergreen/orchestration/drivers_orchestration.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.evergreen/orchestration/drivers_orchestration.py b/.evergreen/orchestration/drivers_orchestration.py index 004ae6346..697f88498 100644 --- a/.evergreen/orchestration/drivers_orchestration.py +++ b/.evergreen/orchestration/drivers_orchestration.py @@ -372,7 +372,11 @@ def get_orchestration_data(opts): ) data["requireApiVersion"] = "1" - if opts.tls_allow_invalid_certificates and "sslParams" in data: + if opts.tls_allow_invalid_certificates: + if "sslParams" not in data: + raise ValueError( + "--tls-allow-invalid-certificates requires TLS to be configured, but no sslParams found in orchestration data" + ) data["sslParams"]["tlsAllowInvalidCertificates"] = True # If running on Docker, update the orchestration file to be docker-friendly. From f873d0a90b1c119e6971c61cf0d26f0f421bc684 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Thu, 11 Jun 2026 13:23:43 -0500 Subject: [PATCH 9/9] Update .evergreen/orchestration/drivers_orchestration.py Co-authored-by: Ezra Chung <88335979+eramongodb@users.noreply.github.com> --- .evergreen/orchestration/drivers_orchestration.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.evergreen/orchestration/drivers_orchestration.py b/.evergreen/orchestration/drivers_orchestration.py index 697f88498..352d620f3 100644 --- a/.evergreen/orchestration/drivers_orchestration.py +++ b/.evergreen/orchestration/drivers_orchestration.py @@ -145,8 +145,7 @@ def get_options(): other_group.add_argument( "--tls-allow-invalid-certificates", action="store_true", - help="Whether to pass --tlsAllowInvalidCertificates to mongod, bypassing " - "certificate revocation (OCSP) enforcement", + help="Whether to pass --tlsAllowInvalidCertificates to mongod", ) other_group.add_argument( "--arch",