## SSL Certificate Hostname Validation 

Description The SSL certificate validation now checks the Common Name ( CN ) and the Subject Alternative Name ( SAN ) fields to ensure that either the CN or one of the SAN entries matches the hostname of the server. As a result, if you currently use SSL and neither the CN nor any of the SAN entries of your current SSL certificates match the hostnames, upgrading to version 2.6 will cause the SSL connections to fail. 

Solution To allow for the continued use of these certificates, MongoDB provides the allowInvalidCertificates setting. The setting is available for: 

• mongod and mongos to bypass the validation of SSL certificates on other servers in the cluster. 

• mongo shell, MongoDB tools that support SSL (page 350), and the C++ driver to bypass the validation of server certificates. 

When using the allowInvalidCertificates setting, MongoDB logs as a warning the use of the invalid certificates. 

Warning: The allowInvalidCertificates setting bypasses the other certificate validation, such as checks for expiration and valid signatures. 

## 2dsphere Index Version 2 

Description MongoDB 2.6 introduces a version 2 of the 2dsphere index (page 496). If a document lacks a 2dsphere index field (or the field is null or an empty array), MongoDB does not add an entry for the document to the 2dsphere index. For inserts, MongoDB inserts the document but does not add to the 2dsphere index. 

Previous version would not insert documents where the 2dsphere index field is a null or an empty array. For documents that lack the 2dsphere index field, previous versions would insert and index the document. 

Solution To revert to old behavior, create the 2dsphere index with { "2dsphereIndexVersion" : 1 } to create a version 1 index. However, version 1 index cannot use the new GeoJSON geometries. 

## See also: 

2dsphere (Version 2) (page 496) 

## Log Messages 

## Timestamp Format Change 

Description Each message now starts with the timestamp format given in Time Format Changes (page 866). Previous versions used the ctime format. 

Solution MongoDB adds a new option --timeStampFormat which supports timestamp format in ctime , iso8601-utc , and iso8601-local (new default). 

## Package Configuration Changes 

## Default bindIp for RPM/DEB Packages 

Description In the official MongoDB packages in RPM (Red Hat, CentOS, Fedora Linux, and derivatives) and DEB (Debian, Ubuntu, and derivatives), the default bindIp value attaches MongoDB components to the localhost interface only . These packages set this default in the default configuration file (i.e. /etc/mongod.conf .) 

Solution If you use one of these packages and have not modified the default /etc/mongod.conf file, you will need to set bindIp before or during the upgrade. 

