• --sslPEMKeyPassword option if the client certificate-key file is encrypted. MongoDB Documentation, Release 3.0.4 For a complete list of the mongo shell’s SSL settings, see mongo-shell-ssl . Connect to MongoDB Instance with SSL Encryption To connect to a mongod or mongos instance that requires only a SSL encryption mode (page 343), start mongo shell with --ssl and include the --sslCAFile to validate the server certificates. mongo --ssl --sslCAFile /etc/ssl/ca.pem Changed in version 3.0: When running mongo with the --ssl option, you must include either --sslCAFile or --sslAllowInvalidCertificates . This restriction does not apply to the MongoDB tools. However, running the tools without -sslCAFile creates the same vulnerability to invalid certificates. Connect to MongoDB Instance that Requires Client Certificates To connect to a mongod or mongos that re- quires CA-signed client certificates (page 344), start the mongo shell with --ssl , the --sslPEMKeyFile option to specify the signed certificate-key file, and the --sslCAFile to validate the server certificates. mongo --ssl --sslPEMKeyFile /etc/ssl/client.pem --sslCAFile /etc/ssl/ca.pem Changed in version 3.0: When running mongo with the --ssl option, you must include either --sslCAFile or --sslAllowInvalidCertificates . This restriction does not apply to the MongoDB tools. However, running the tools without -sslCAFile creates the same vulnerability to invalid certificates. Connect to MongoDB Instance that Validates when Presented with a Certificate To connect to a mongod or mongos instance that only requires valid certificates when the client presents a certificate (page 345), start mongo shell either: Changed in version 3.0: When running mongo with the --ssl option, you must include either --sslCAFile or --sslAllowInvalidCertificates . This restriction does not apply to the MongoDB tools. However, running the tools without -sslCAFile creates the same vulnerability to invalid certificates. For example, if mongod is running with weak certificate validation, both of the following mongo shell clients can connect to that mongod : mongo --ssl --sslCAFile /etc/ssl/ca.pem mongo --ssl --sslPEMKeyFile /etc/ssl/client.pem --sslCAFile /etc/ssl/ca.pem Important: If the client presents a certificate, the certificate must be valid. The MongoDB Cloud Manager Monitoring agent will also have to connect via SSL in order to gather its statistics. Because the agent already utilizes SSL for its communications to the MongoDB Cloud Manager servers, this is just a matter of enabling SSL support in MongoDB Cloud Manager itself on a per host basis. • with the --ssl , --sslCAFile , and no certificate or • with the --ssl , --sslCAFile , and a valid signed certificate. MongoDB Cloud Manager and Ops Manager Monitoring Agent 347 6.3. Security Tutorials