MongoDB Documentation, Release 3.0.4 .pem File Before you can use SSL, you must have a .pem file containing a public key certificate and its associated private key. MongoDB can use any valid SSL certificate issued by a certificate authority, or a self-signed certificate. If you use a self-signed certificate, although the communications channel will be encrypted, there will be no validation of server identity. Although such a situation will prevent eavesdropping on the connection, it leaves you vulnerable to a man-in- the-middle attack. Using a certificate signed by a trusted certificate authority will permit MongoDB drivers to verify the server’s identity. In general, avoid using self-signed certificates unless the network is trusted. Additionally, with regards to authentication among replica set/sharded cluster members (page 323), in order to mini- mize exposure of the private key and allow hostname validation, it is advisable to use different certificates on different servers. For testing purposes, you can generate a self-signed certificate and private key on a Unix system with a command that resembles the following: cd /etc/ssl/ openssl req -newkey rsa:2048 -new -x509 -days 365 -nodes -out mongodb-cert.crt -keyout This operation generates a new, self-signed certificate with no passphrase that is valid for 365 days. Once you have the certificate, concatenate the certificate and private key to a .pem file, as in the following example: cat mongodb-cert.key mongodb-cert.crt > mongodb.pem Use x.509 Certificates to Authenticate Clients (page 361) See also: Procedures Set Up mongod and mongos with SSL Certificate and Key To use SSL in your MongoDB deployment, include the following run-time options with mongod and mongos : Consider the following syntax for mongod : mongod --sslMode requireSSL --sslPEMKeyFile <pem> For example, given an SSL certificate located at /etc/ssl/mongodb.pem , configure mongod to use SSL encryp- tion for all connections with the following command: mongod --sslMode requireSSL --sslPEMKeyFile /etc/ssl/mongodb.pem • net.ssl.mode set to requireSSL . This setting restricts each server to use only SSL encrypted connections. You can also specify either the value allowSSL or preferSSL to set up the use of mixed SSL modes on a port. See net.ssl.mode for details. • PEMKeyfile with the .pem file that contains the SSL certificate and key. • Specify <pem> with the full path name to the certificate. • If the private key portion of the <pem> is encrypted, specify the passphrase. See SSL Certificate Passphrase (page 345). Note: You may also specify these options in the configuration file , as in the following examples: If using the YAML configuration file format : 343 6.3. Security Tutorials