Description
The README's "Production (TLS/X.509)" section documents a workflow in which every step is missing from the repository:
make mongodb-prod — no such Makefile targetmake api-prod — no such Makefile targetmake certs — listed in the Makefile targets table; no such target./certs/generate-certs.sh — not in the repo
The section describes the script's outputs in detail (certs/ca/ca.pem, certs/server/mongodb-server-bundle.pem, certs/clients/cfdb-api-bundle.pem, certs/clients/cfdb-materializer-bundle.pem) and instructs the reader to run ./certs/generate-certs.sh --help for full usage, so it reads as a working feature rather than a plan.
This is distinct from the worker mTLS material, which does exist and works: make worker-certs and certs/generate-worker-certs.sh are real and documented separately under "Worker mTLS". The overlap in naming makes the missing path easy to mistake for the present one.
Expected Behavior
Either the documented commands exist and work, or the section does not claim they do. Anyone following the README to stand up a TLS-enabled local MongoDB should not discover four missing artifacts one at a time.
Root Cause
Not yet investigated — most likely the client-cert tooling was removed or never landed while the documentation for it stayed. Two ways out, and the choice is a judgement call rather than obvious:
- Implement
certs/generate-certs.sh plus the certs, mongodb-prod and api-prod targets, mirroring the shape of the working generate-worker-certs.sh.
- Cut the section and the
make certs table row, pointing production TLS at the deployed stacks (cloudformation/database.yml provisions DocumentDB with TLS) rather than at a local re-creation of it.
Worth deciding deliberately: the deployed environments do not use this path, so the question is whether local X.509 development is something the project wants to support at all.
Description
The README's "Production (TLS/X.509)" section documents a workflow in which every step is missing from the repository:
make mongodb-prod— no such Makefile targetmake api-prod— no such Makefile targetmake certs— listed in the Makefile targets table; no such target./certs/generate-certs.sh— not in the repoThe section describes the script's outputs in detail (
certs/ca/ca.pem,certs/server/mongodb-server-bundle.pem,certs/clients/cfdb-api-bundle.pem,certs/clients/cfdb-materializer-bundle.pem) and instructs the reader to run./certs/generate-certs.sh --helpfor full usage, so it reads as a working feature rather than a plan.This is distinct from the worker mTLS material, which does exist and works:
make worker-certsandcerts/generate-worker-certs.share real and documented separately under "Worker mTLS". The overlap in naming makes the missing path easy to mistake for the present one.Expected Behavior
Either the documented commands exist and work, or the section does not claim they do. Anyone following the README to stand up a TLS-enabled local MongoDB should not discover four missing artifacts one at a time.
Root Cause
Not yet investigated — most likely the client-cert tooling was removed or never landed while the documentation for it stayed. Two ways out, and the choice is a judgement call rather than obvious:
certs/generate-certs.shplus thecerts,mongodb-prodandapi-prodtargets, mirroring the shape of the workinggenerate-worker-certs.sh.make certstable row, pointing production TLS at the deployed stacks (cloudformation/database.ymlprovisions DocumentDB with TLS) rather than at a local re-creation of it.Worth deciding deliberately: the deployed environments do not use this path, so the question is whether local X.509 development is something the project wants to support at all.