MongoDB Documentation, Release 3.0.4 Upgrade all nodes of the cluster to these settings. You may also specify these options in the configuration file . If using a YAML format configuration file , specify the following settings in the file: Or, if using the older configuration file format$^{49}$: net: ssl: mode: <disabled|allowSSL|preferSSL|requireSSL> PEMKeyFile: <path to TLS/SSL certificate and key PEM file> CAFile: <path to root CA PEM file> sslMode = <disabled|allowSSL|preferSSL|requireSSL> sslPEMKeyFile = <path to TLS/SSL certificate and key PEM file> sslCAFile = <path to root CA PEM file> 2. Switch all clients to use TLS/SSL. See TLS/SSL Configuration for Clients (page 346). 3. For each node of a cluster, use the setParameter command to update the sslMode to preferSSL . 50 With preferSSL as its net.ssl.mode , the node accepts both TLS/SSL and non-TLS/non-SSL incoming connections, and its connections to other servers use TLS/SSL. For example: 4. For each node of the cluster, use the setParameter command to update the sslMode to requireSSL . 1 With requireSSL as its net.ssl.mode , the node will reject any non-TLS/non-SSL connections. For example: 5. After the upgrade of all nodes, edit the configuration file with the appropriate TLS/SSL settings to ensure that upon subsequent restarts, the cluster uses TLS/SSL. $^{49}$http://docs.mongodb.org/v2.4/reference/configuration-options 50 As an alternative to using the setParameter command, you can also restart the nodes with the appropriate TLS/SSL options and values. 351 6.3. Security Tutorials Important: A full description of FIPS and TLS/SSL is beyond the scope of this document. This tutorial assumes prior knowledge of FIPS and TLS/SSL. The Federal Information Processing Standard (FIPS) is a U.S. government computer security standard used to certify software modules and libraries that encrypt and decrypt data securely. You can configure MongoDB to run with a FIPS 140-2 certified library for OpenSSL. Configure FIPS to run by default or as needed from the command line. New in version 2.6. db.getSiblingDB('admin').runCommand( { setParameter: 1, sslMode: "requireSSL" } ) At this point, all connections should be using TLS/SSL. Upgrade all nodes of the cluster to these settings. db.getSiblingDB('admin').runCommand( { setParameter: 1, sslMode: "preferSSL" } ) Configure MongoDB for FIPS Overview Prerequisites