Securing Your MongoDB Cluster with TLS/SSL: A Complete Configuration Guide

# /etc/mongod.conf — production TLS configuration

net:
  port: 27017
  bindIp: 0.0.0.0          # Or restrict to specific IPs / VPC CIDR
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb/mongodb-node1.pem
    certificateKeyFilePassword: ""   # Leave empty if key is unencrypted
                                     # Use environment variable injection for encrypted keys
    CAFile: /etc/ssl/mongodb/ca-cert.pem
    allowInvalidHostnames: false     # Never set true in production
    allowInvalidCertificates: false  # Never set true in production
    disabledProtocols: "TLS1_0,TLS1_1"  # Enforce TLS 1.2 minimum

security:
  authorization: enabled
  clusterAuthMode: x509             # Use x.509 for internal member auth

replication:
  replSetName: "rs0"

storage:
  dbPath: /var/lib/mongo

sudo systemctl restart mongod
sudo systemctl status mongod

# Verify TLS is active
openssl s_client -connect mongodb-node1.internal.example.com:27017 \
  -CAfile /etc/ssl/mongodb/ca-cert.pem \
  -servername mongodb-node1.internal.example.com < /dev/null

# Basic TLS connection
mongosh "mongodb://mongodb-node1.internal.example.com:27017/admin" \
  --tls \
  --tlsCAFile /etc/ssl/mongodb/ca-cert.pem \
  --username admin \
  --password

# Using a client certificate for x.509 authentication
mongosh "mongodb://mongodb-node1.internal.example.com:27017/admin" \
  --tls \
  --tlsCAFile /etc/ssl/mongodb/ca-cert.pem \
  --tlsCertificateKeyFile /etc/ssl/mongodb/client-cert.pem \
  --authenticationMechanism MONGODB-X509

# Standard username/password auth over TLS
mongodb://appuser:password@mongodb-node1.internal.example.com:27017,mongodb-node2.internal.example.com:27017/mydb?replicaSet=rs0&tls=true&tlsCAFile=/etc/ssl/mongodb/ca-cert.pem

# x.509 client certificate auth
mongodb://mongodb-node1.internal.example.com:27017/mydb?replicaSet=rs0&tls=true&tlsCAFile=/etc/ssl/mongodb/ca-cert.pem&tlsCertificateKeyFile=/etc/ssl/mongodb/client.pem&authMechanism=MONGODB-X509

import pymongo
import ssl

client = pymongo.MongoClient(
    "mongodb://mongodb-node1.internal.example.com:27017/",
    tls=True,
    tlsCAFile="/etc/ssl/mongodb/ca-cert.pem",
    tlsCertificateKeyFile="/etc/ssl/mongodb/client.pem",
    replicaSet="rs0"
)
db = client.mydb

const { MongoClient } = require('mongodb');

const client = new MongoClient(
  'mongodb://mongodb-node1.internal.example.com:27017/?replicaSet=rs0',
  {
    tls: true,
    tlsCAFile: '/etc/ssl/mongodb/ca-cert.pem',
    tlsCertificateKeyFile: '/etc/ssl/mongodb/client.pem',
  }
);

await client.connect();

# Generate member certificate for node1
openssl req -newkey rsa:4096 -nodes -keyout rs0-member1-key.pem \
  -out rs0-member1.csr \
  -subj "/C=US/ST=California/O=YourOrg/OU=MongoDBReplicaSet/CN=mongodb-node1.internal.example.com"

openssl x509 -req -in rs0-member1.csr -CA ca-cert.pem -CAkey ca-key.pem \
  -CAcreateserial -out rs0-member1-cert.pem -days 730 \
  -passin pass:YOUR_CA_PASSPHRASE

cat rs0-member1-cert.pem rs0-member1-key.pem > rs0-member1.pem
chmod 600 rs0-member1.pem
chown mongod:mongod rs0-member1.pem

// Connect as admin, then create the x.509 user
db.getSiblingDB("$external").runCommand({
  createUser: "CN=app-service,OU=Applications,O=YourOrg,C=US",
  roles: [
    { role: "readWrite", db: "mydb" }
  ],
  writeConcern: { w: "majority" }
});

# Step 1: Deploy certificates to all nodes. Set mode to allowTLS.
# This allows both TLS and non-TLS connections — existing clients still work.
net:
  tls:
    mode: allowTLS

# Step 2: Rolling restart of replica set members (secondaries first, then primary).
# Verify all members are healthy: rs.status()

# Step 3: Update all application clients to connect with TLS.
# Verify no plaintext connections remain (check network firewall logs or
# use tcpdump to confirm all traffic is encrypted).

# Step 4: Change mode to requireTLS on all members (rolling restart again).
net:
  tls:
    mode: requireTLS

# Step 5: Verify with mongosh — a plaintext connection attempt should now fail.
mongosh "mongodb://mongodb-node1.internal.example.com:27017/admin"
# Expected: MongoServerError: SSL is required

# This should fail after enforcing requireTLS
mongosh --host mongodb-node1.internal.example.com --port 27017 --eval "db.adminCommand({ping: 1})"
# Output should be: MongoNetworkError or SSL handshake error

# Step 1: Generate new certificates using the same CA
# (repeat the OpenSSL steps from the Generating Certificates section)
# New cert file: mongodb-node1-new.pem

# Step 2: Replace the certificate file on disk
# Use an atomic rename to avoid a window where the file is partially written
cp /etc/ssl/mongodb/mongodb-node1-new.pem /etc/ssl/mongodb/mongodb-node1.pem.new
mv /etc/ssl/mongodb/mongodb-node1.pem.new /etc/ssl/mongodb/mongodb-node1.pem
chown mongod:mongod /etc/ssl/mongodb/mongodb-node1.pem
chmod 600 /etc/ssl/mongodb/mongodb-node1.pem

# Step 3: Signal mongod to reload certificates (no restart required)
# Find the mongod PID
MONGOD_PID=$(pgrep -x mongod)
sudo kill -SIGHUP $MONGOD_PID

# OR use the admin command from mongosh (MongoDB 4.4+)
db.adminCommand({ rotateCertificates: 1 })

openssl s_client -connect mongodb-node1.internal.example.com:27017 \
  -CAfile /etc/ssl/mongodb/ca-cert.pem < /dev/null 2>&1 | \
  grep -E "subject|issuer|notAfter"

#!/bin/bash
# /usr/local/bin/rotate-mongo-cert.sh
# Run 30 days before expiry via cron

set -euo pipefail

CERT_DIR="/etc/ssl/mongodb"
CA_CERT="${CERT_DIR}/ca-cert.pem"
NODE_CERT="${CERT_DIR}/mongodb-node1.pem"
MONGOD_PID=$(pgrep -x mongod)

# Generate new certificate (assumes CA key is in secrets manager)
# ... OpenSSL commands here ...

# Atomic replacement
mv "${CERT_DIR}/mongodb-node1-new.pem" "${NODE_CERT}"
chown mongod:mongod "${NODE_CERT}"
chmod 600 "${NODE_CERT}"

# Signal reload
kill -SIGHUP "${MONGOD_PID}"

echo "Certificate rotated successfully at $(date)"