MongoDB Documentation, Release 3.0.4 Use Configuration File You can specify the configuration for MongoDB in a YAML formatted configuration file, as in the following example: See security.clusterAuthMode , net.ssl.mode , net.ssl.PEMKeyFile , net.ssl.CAFile , and net.ssl.clusterFile for more information on the settings. To upgrade clusters that are currently using keyfile authentication to x.509 authentication, use a rolling upgrade pro- cess. Clusters Currently Using TLS/SSL For clusters using TLS/SSL and keyfile authentication, to upgrade to x.509 cluster authentication, use the following rolling upgrade process: mongod --replSet <name> --sslMode requireSSL --clusterAuthMode sendKeyFile --sslClusterFile With this setting, each node continues to use its keyfile to authenticate itself as a member. However, each node can now accept either a keyfile or an x.509 certificate from other members to authenticate those members. Upgrade all nodes of the cluster to this setting. db.getSiblingDB('admin').runCommand( { setParameter: 1, clusterAuthMode: "sendX509" } ) With this setting, each node uses its x.509 certificate, specified with the --sslClusterFile option in the previous step, to authenticate itself as a member. However, each node continues to accept either a keyfile or an x.509 certificate from other members to authenticate those members. Upgrade all nodes of the cluster to this setting. db.getSiblingDB('admin').runCommand( { setParameter: 1, clusterAuthMode: "x509" } ) See --clusterAuthMode for the various modes and their descriptions. 1. For each node of a cluster, start the node with the option --clusterAuthMode set to sendKeyFile and the option --sslClusterFile set to the appropriate path of the node’s certificate. Include other TLS/SSL options (page 342) as well as any other options that are required for your specific configuration. For example: 2. Then, for each node of a cluster, connect to the node and use the setParameter command to update the clusterAuthMode to sendX509 . 54 For example, 3. Optional but recommended. Finally, for each node of the cluster, connect to the node and use the setParameter command to update the clusterAuthMode to x509 to only use the x.509 certificate for authentication. 1 For example: 4. After the upgrade of all nodes, edit the configuration file with the appropriate x.509 settings to ensure that upon subsequent restarts, the cluster uses x.509 authentication. 54 As an alternative to using the setParameter command, you can also restart the nodes with the appropriate TLS/SSL and x509 options and values. 365 6.3. Security Tutorials Upgrade from Keyfile Authentication to x.509 Authentication security: clusterAuthMode: x509 net: ssl: mode: requireSSL PEMKeyFile: <path to TLS/SSL certificate and key PEM file> CAFile: <path to root CA PEM file> clusterFile: <path to x.509 membership certificate and key PEM file>