MongoDB Documentation, Release 3.0.4 Warning: If the --sslCAFile option and its target file are not specified, x.509 client and member authenti- cation will not function. mongod , and mongos in sharded systems, will not be able to verify the certificates of processes connecting to it against the trusted certificate authority (CA) that issued them, breaking the certificate chain. As of version 2.6.4, mongod will not start with x.509 authentication enabled if the CA file is not specified. Starting in MongoDB 2.6, you can specify the configuration for MongoDB in YAML format , e.g.: Use Configuration File You may also specify these options in the configuration file . For backwards compatibility, you can also specify the configuration using the older configuration file format$^{53}$, e.g.: Include any additional options, TLS/SSL or otherwise, that are required for your specific configuration. Add x.509 Certificate subject as a User To authenticate with a client certificate, you must first add the value of the subject from the client certificate as a MongoDB user. Each unique x.509 client certificate corresponds to a single MongoDB user; i.e. you cannot use a single client certificate to authenticate more than one MongoDB user. For example, in the mongo shell, to add the user with both the readWrite role in the test database and the userAdminAnyDatabase role which is defined only in the admin database: $^{53}$http://docs.mongodb.org/v2.4/reference/configuration-options 362 Chapter 6. Security security: clusterAuthMode: x509 net: ssl: mode: requireSSL PEMKeyFile: <path to TLS/SSL certificate and key PEM file> CAFile: <path to root CA PEM file> clusterAuthMode = x509 sslMode = requireSSL sslPEMKeyFile = <path to TLS/SSL certificate and key PEM file> sslCAFile = <path to the root CA PEM file> openssl x509 -in <pathToClient PEM> -inform PEM -subject -nameopt RFC2253 The command returns the subject string as well as certificate: subject= CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry -----BEGIN CERTIFICATE----- # ... -----END CERTIFICATE----- 1. You can retrieve the subject from the client certificate with the following command: 2. Add the value of the subject , omitting the spaces, from the certificate as a user. db.getSiblingDB("$external").runCommand( { createUser: "CN=myName,OU=myOrgUnit,O=myOrg,L=myLocality,ST=myState,C=myCountry", roles: [ { role: 'readWrite', db: 'test' }, { role: 'userAdminAnyDatabase', db: 'admin' } ], writeConcern: { w: "majority" , wtimeout: 5000 }