Secure Your Data

Sample Application

You can use the following sample application to test the code examples on this page. To use the sample application, perform the following steps:

1. Ensure you have the MongoDB PHP Library installed in your project. To learn more about installing the MongoDB PHP Library, see the Download and Install guide.

2. Copy the following code and paste it into a new .php file.

3. Copy a code example from this page and paste it on the specified lines in the file.

MongoDB\Client Credentials

The following code shows how to pass AWS credentials to the MongoDB\Client constructor to authenticate with MONGODB-AWS:

$uriOptions = [
    'username' => '<AWS IAM access key ID>',
    'password' => '<AWS IAM secret access key>',
    'authMechanism' => 'MONGODB-AWS',
];
$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>',
    $uriOptions,
);

$uri = 'mongodb://<AWS IAM access key ID>:<AWS IAM secret access key>@<hostname>:<port>/?authMechanism=MONGODB-AWS';
$client = new MongoDB\Client($uri);

To learn more about authenticating with AWS by retrieving MongoDB\Client credentials, see MongoDB\Client Credentials in the Authentication guide.

External Credentials

The following code shows how to authenticate with MONGODB-AWS when obtaining credentials from environment variables, an AssumeRoleWithWebIdentity request, ECS metadata, or EC2 instance metadata:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>',
    ['authMechanism' => 'MONGODB-AWS'],
);

$uri = 'mongodb://<hostname>:<port>/?authMechanism=MONGODB-AWS';
$client = new MongoDB\Client($uri);

To learn more about authenticating with AWS by obtaining external credentials, see the following sections in the Authentication guide:

• Environment Variables

• AssumeRoleWithWebIdentity Request

• ECS Metadata

• EC2 Instance Metadata

Enable TLS

The following code shows how to enable TLS for the connection to your MongoDB instance:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    ['tls' => true],
);

$uri = 'mongodb://<hostname>:<port>/?tls=true';
$client = new MongoDB\Client($uri);

To learn more about enabling TLS, see Enable TLS in the TLS Configuration guide.

Specify a Certificate Authority (CA) File

The following code shows how to specify the path to your CA file for the connection to your MongoDB instance:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    ['tls' => true, 'tlsCAFile' => '/path/to/ca.pem'],
);

$uri = 'mongodb://<hostname>:<port>/?tls=true&tlsCAFile=/path/to/ca.pem';
$client = new MongoDB\Client($uri);

To learn more about specifying a CA file, see Specify a CA File in the TLS Configuration guide.

Disable OCSP Checks

The following code shows how to prevent the driver from contacting the OCSP endpoint:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    ['tls' => true, 'tlsDisableOCSPEndpointCheck' => true],
);

$uri = 'mongodb://<hostname>:<port>/?tls=true&tlsDisableOCSPEndpointCheck=true';
$client = new MongoDB\Client($uri);

To learn more about disabling OCSP checks, see OCSP in the TLS Configuration guide.

Specify a Certificate Revocation List (CRL)

The following code shows how to instruct the driver to verify the server's certificate against a CRL:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    ['tls' => true],
    ['crl_file' => '/path/to/file.pem'],
);

To learn more about specifying a CRL, see Certificate Revocation List in the TLS configuration guide.

Present a Client Certificate

The following code shows how to specify the client certificate that the driver presents to your MongoDB deployment:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    ['tls' => true, 'tlsCertificateKeyFile' => '/path/to/client.pem'],
);

$uri = 'mongodb://<hostname>:<port>/?tls=true&tlsCertificateKeyFile=/path/to/client.pem';
$client = new MongoDB\Client($uri);

To learn more about specifying a client certificate, see Present a Client Certificate in the TLS Configuration guide.

Provide a Certificate Key File Password

The following code shows how to specify the password for your client certificate:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    [
        'tls' => true,
        'tlsCertificateKeyFile' => '/path/to/client.pem',
        'tlsCertificateKeyFilePassword' => '<password>',
    ],
);

$uri = 'mongodb://<hostname>:<port>/?tls=true&tlsCertificateKeyFile=/path/to/client.pem&tlsCertificateKeyFilePassword=<password>';
$client = new MongoDB\Client($uri);

To learn more about providing a key file password, see Provide a Key Password in the TLS Configuration guide.

Allow Insecure TLS

The following code shows how to relax TLS constraints, which has the same effect as disabling both certificate validation and hostname verification:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    ['tls' => true, 'tlsInsecure' => true],
);

$uri = 'mongodb://<hostname>:<port>/?tls=true&tlsInsecure=true';
$client = new MongoDB\Client($uri);

To learn more about allowing insecure TLS, see Allow Insecure TLS in the TLS Configuration guide.

Disable Certificate Validation

The following code shows how to disable certificate validation:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    ['tls' => true, 'tlsAllowInvalidCertificates' => true],
);

$uri = 'mongodb://<hostname>:<port>/?tls=true&tlsAllowInvalidCertificates=true';
$client = new MongoDB\Client($uri);

To learn more about disabling certificate validation, see Allow Insecure TLS in the TLS Configuration guide.

Disable Hostname Verification

The following code shows how to disable hostname verification:

$client = new MongoDB\Client(
    'mongodb://<hostname>:<port>/',
    ['tls' => true, 'tlsAllowInvalidHostnames' => true],
);

$uri = 'mongodb://<hostname>:<port>/?tls=true&tlsAllowInvalidHostnames=true';
$client = new MongoDB\Client($uri);

To learn more about disabling hostname verification, see Allow Insecure TLS in the TLS Configuration guide.