1 files changed, 26 insertions, 31 deletions

diff --git a/src/mongo/util/net/ssl_manager_apple.cpp b/src/mongo/util/net/ssl_manager_apple.cpp
index f3e0f4d6652..ec77dc17722 100644
--- a/src/mongo/util/net/ssl_manager_apple.cpp
+++ b/src/mongo/util/net/ssl_manager_apple.cpp
@@ -1369,15 +1369,20 @@ SSLManagerApple::SSLManagerApple(const SSLParams& params, bool isServer)
         }
     }
 
-    // If the user has specified --setParameter tlsUseSystemCA=true, then no params.sslCAFile nor
-    // params.sslClusterCAFile will be defined, and the SSL Manager will fall back to the System CA.
     if (!params.sslCAFile.empty()) {
         auto ca = uassertStatusOK(loadPEM(params.sslCAFile, "", kLoadPEMStripKeys));
         _clientCA = std::move(ca);
+        _sslConfiguration.hasCA = _clientCA && ::CFArrayGetCount(_clientCA.get());
+    }
+
+    if (!params.sslCertificateSelector.empty() || !params.sslClusterCertificateSelector.empty()) {
+        // By using the system keychain, we acknowledge it exists.
+        _sslConfiguration.hasCA = true;
     }
 
     if (!_clientCA) {
-        // No explicit CA was specified, use the Keychain CA explicitly
+        // No explicit CA was specified, use the Keychain CA explicitly on client connects,
+        // even though we're going to pretend it doesn't exist on server.
         ::CFArrayRef certs = nullptr;
         uassertOSStatusOK(SecTrustCopyAnchorCertificates(&certs));
         _clientCA.reset(certs);
@@ -1552,6 +1557,17 @@ Future<SSLPeerInfo> SSLManagerApple::parseAndValidatePeerCertificate(
 
     recordTLSVersion(tlsVersionStatus.getValue(), hostForLogging);
 
+    /* While we always have a system CA via the Keychain,
+     * we'll pretend not to in terms of validation if the server
+     * was started using a PEM file (legacy mode).
+     *
+     * When a certificate selector is used, we'll override hasCA to true
+     * so that the validation path runs anyway.
+     */
+    if (!_sslConfiguration.hasCA && isSSLServer) {
+        return Future<SSLPeerInfo>::makeReady(SSLPeerInfo(sniName));
+    }
+
     const auto badCert = [&](StringData msg, bool warn = false) -> Future<SSLPeerInfo> {
         if (warn) {
             LOGV2_WARNING(23209,
@@ -1576,7 +1592,7 @@ Future<SSLPeerInfo> SSLManagerApple::parseAndValidatePeerCertificate(
             return SSLPeerInfo(sniName);
         } else {
             if (status == ::errSecSuccess) {
-                return badCert(str::stream() << "No SSL certificate provided by peer: "
+                return badCert(str::stream() << "no SSL certificate provided by peer: "
                                              << stringFromOSStatus(status),
                                _weakValidation);
             } else {
@@ -1654,14 +1670,11 @@ Future<SSLPeerInfo> SSLManagerApple::parseAndValidatePeerCertificate(
         return swPeerSubjectName.getStatus();
     }
     const auto peerSubjectName = std::move(swPeerSubjectName.getValue());
-    // The cipher will be presented as a number.
-    ::SSLCipherSuite cipher;
-    uassertOSStatusOK(::SSLGetNegotiatedCipher(ssl, &cipher));
-
-    LOGV2_INFO(6723803,
-               "Accepted TLS connection from peer",
-               "peerSubjectName"_attr = peerSubjectName,
-               "cipher"_attr = cipher);
+    LOGV2_DEBUG(23207,
+                2,
+                "Accepted TLS connection from peer: {peerSubjectName}",
+                "Accepted TLS connection from peer",
+                "peerSubjectName"_attr = peerSubjectName);
 
     // Server side.
     if (remoteHost.empty()) {
@@ -1874,26 +1887,8 @@ MONGO_INITIALIZER_WITH_PREREQUISITES(SSLManager, ("EndStartupOptionHandling"))
     kMongoDBRolesOID = ::CFStringCreateWithCString(
         nullptr, mongodbRolesOID.identifier.c_str(), ::kCFStringEncodingUTF8);
 
-    // TODO SERVER-67419 This retry logic is a workaround; reconsider this approach after
-    // investigation.
-    constexpr int kMaxRetries = 10;
     if (!isSSLServer || (sslGlobalParams.sslMode.load() != SSLParams::SSLMode_disabled)) {
-        for (int i = 0; i < kMaxRetries; i++) {
-            try {
-                theSSLManagerCoordinator = new SSLManagerCoordinator();
-                return;
-            } catch (const ExceptionFor<ErrorCodes::InvalidSSLConfiguration>& e) {
-                bool isRetriableError = nullptr != strstr(e.what(), "No keychain is available.");
-                if (!isRetriableError || i == kMaxRetries - 1) {
-                    // Rethrow if a different error or we fail on final iteration
-                    throw;
-                }
-                LOGV2_INFO(6741800,
-                           "Caught exception during apple SSLManagerCoordinator creation, retrying",
-                           "try"_attr = i,
-                           "error"_attr = e.what());
-            }
-        }
+        theSSLManagerCoordinator = new SSLManagerCoordinator();
     }
 }