MongoDB Documentation, Release 3.0.4 net: ssl: mode: requireSSL PEMKeyFile: /etc/ssl/mongodb.pem net: ssl: mode: requireSSL PEMKeyFile: /etc/ssl/mongodb.pem CAFile: /etc/ssl/ca.pem Or, if using the older older configuration file format$^{37}$: sslMode = requireSSL sslPEMKeyFile = /etc/ssl/mongodb.pem To connect, to mongod and mongos instances using SSL, the mongo shell and MongoDB tools must include the --ssl option. See TLS/SSL Configuration for Clients (page 346) for more information on connecting to mongod and mongos running with SSL. Upgrade a Cluster to Use TLS/SSL (page 350) Set Up mongod and mongos with Certificate Validation To set up mongod or mongos for SSL encryption using an SSL certificate signed by a certificate authority, include the following run-time options during startup: Consider the following syntax for mongod : mongod --sslMode requireSSL --sslPEMKeyFile <pem> --sslCAFile <ca> For example, given a signed SSL certificate located at /etc/ssl/mongodb.pem and the certificate authority file at /etc/ssl/ca.pem , you can configure mongod for SSL encryption as follows: mongod --sslMode requireSSL --sslPEMKeyFile /etc/ssl/mongodb.pem --sslCAFile /etc/ssl/ca.pem You may also specify these options in the configuration file , as in the following examples: If using the YAML configuration file format : Or, if using the older older configuration file format$^{38}$: Chapter 6. Security 344 $^{37}$http://docs.mongodb.org/v2.4/reference/configuration-options $^{38}$http://docs.mongodb.org/v2.4/reference/configuration-options • Specify the <pem> file and the <ca> file with either the full path name or the relative path name. • If the <pem> is encrypted, specify the passphrase. See SSL Certificate Passphrase (page 345). Note: See also: • net.ssl.mode set to requireSSL . This setting restricts each server to use only SSL encrypted connections. You can also specify either the value allowSSL or preferSSL to set up the use of mixed SSL modes on a port. See net.ssl.mode for details. • PEMKeyfile with the name of the .pem file that contains the signed SSL certificate and key. • CAFile with the name of the .pem file that contains the root certificate chain from the Certificate Authority.