DOCS-14586 add 509 certificate warning (#269)

* Docs-14586 add 509 certificate warning (#197)

* DOCS-14586 init

* update include verbiage

* names -> name

* Addressing Jason Edits #1

* Glossary update

* **

* ***

* Change glossary link

* Use term decorator for Subject Alternative Name

* Remove extra line in glossary.txt

* Address Sergey comments #1

* Added ref to mongod and mongos

* correct 5.0 release notes placement

* *

* remove 5.0 release note mentions

* starting in MongoDB 4.2.15

* Add blank line

Author: ianf-mongodb

source/core/security-x.509.txt

@@ -102,6 +102,11 @@ You can also make the TLS/SSL connection first, and then use
 For examples of both cases, see the :ref:`authenticate-with-x509-cert`
 section in :doc:`/tutorial/configure-x509-client-authentication`
 
+TLS Connection X509 Certificate Startup Warning
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. include:: /includes/fact-x509-certificate-client-warning.rst
+
 Member x.509 Certificates
 --------------------------
 

source/includes/fact-x509-certificate-client-warning.rst

@@ -0,0 +1,15 @@
+Starting in MongoDB 4.2.15, :binary:`mongod` and :binary:`mongos` now 
+issue a startup warning when their certificates do not include a 
+:term:`Subject Alternative Name` attribute.
+
+The following platforms do not support common name validation:
+
+- iOS 13 and higher
+- MacOS 10.15 and higher
+- Go 1.15 and higher
+
+Clients using these platforms will not
+:ref:`authenticate <x509-client-authentication>` to 
+MongoDB servers which use X.509 certificate whose hostnames are 
+:ref:`specified by CommonName attributes 
+<KMIP-subject-alternative-name-CN>`.

source/reference/glossary.txt

@@ -921,6 +921,12 @@ Glossary
       always reflect the latest changes to the system. In a database
       system, this means that any system that can provide data must
       reflect the latest writes at all times.
+   
+   Subject Alternative Name
+      Subject Alternative Name (SAN) is an extension of the X.509 
+      certificate which allows an array of values such as IP addresses 
+      and domain names that specify which resources a single security 
+      certificate may secure.
 
    sync
       The :term:`replica set` operation where members replicate data

source/reference/program/mongod.txt

@@ -3188,6 +3188,8 @@ Encryption Key Management Options
    which it can successfully establish a connection. KMIP server
    selection occurs only at startup.
 
+   .. _KMIP-subject-alternative-name-CN:
+
    When connecting to a KMIP server, the :binary:`~bin.mongod`
    verifies that the specified :option:`--kmipServerName` matches the
    Subject Alternative Name ``SAN`` (or, if ``SAN`` is not present, the