On this page本页内容
Clients must have support for TLS/SSL to connect to a 客户端必须支持TLS/SSL才能连接到需要TLS/SSL连接的mongod or a mongos instance that require TLS/SSL connections.mongod或mongos实例。
A full description of TLS/SSL, PKI (Public Key Infrastructure) certificates, and Certificate Authority is beyond the scope of this document. TLS/SSL、PKI（公钥基础设施）证书和证书颁发机构的完整描述超出了本文档的范围。This page assumes prior knowledge of TLS/SSL as well as access to valid certificates.本页假定您已经了解TLS/SSL以及访问有效证书。
mongoshtls Options)tls选项）Starting in version 4.2, MongoDB provides 从4.2版开始，MongoDB提供了与tls options that corresponds to the ssl options. ssl选项相对应的tls选项。The tls options provide identical functionality as the ssl options since MongoDB has always supported TLS 1.0 and later.tls选项提供与ssl选项相同的功能，因为MongoDB始终支持tls 1.0和更高版本。
The procedures in this section use the 本节中的过程使用tls options. tls选项。For procedures using their 有关使用ssl别名的过程，请参阅ssl aliases, see mongosh Configuration (Using ssl Options).mongosh配置（使用ssl选项）。
mongosh provides various TLS/SSL settings, including:提供了各种TLS/SSL设置，包括：
| TLS Option (New in 4.2) | Notes |
|---|---|
--tls | |
--tlsCertificateKeyFile |
mongod / mongos30 days of the mongod/mongos host system time. mongod/mongos主机系统时间的30天内过期，则会记录一条连接警告。 |
--tlsCertificateKeyFilePassword | mongosh's certificate key file is encrypted.mongosh的证书密钥文件已加密。 |
--tlsCAFile | .pem file for verification of the certificate presented by the mongod or the mongos instance..pem文件，用于验证mongod或mongos实例提供的证书。 |
--tlsCertificateSelector |
This option is mutually exclusive with
mongod / mongos30 days of the mongod/mongos host system time. mongod/mongos主机系统时间的30天内过期，则会记录一条连接警告。 |
For a complete list of 有关mongosh's tls options, see TLS Options.mongosh的tls选项的完整列表，请参阅tls选项。
For TLS/SSL connections, 对于TLS/SSL连接，mongosh validates the certificate presented by the mongod or mongos instance:mongosh验证mongod或mongos实例提供的证书：
mongosh--tlsCAFile. --tlsCAFile）。mongosh will fail to connect.mongosh将无法连接。mongosh verifies that the hostname (specified in --host option or the connection string) matches the SAN (or, if SAN is not present, the CN) in the certificate presented by the mongod or mongos. mongosh验证主机名（在--host选项或连接字符串中指定）是否与mongod或mongos提供的证书中的SAN（如果SAN不存在，则为CN）匹配。If 如果存在SAN is present, mongosh does not match against the CN. SAN，则mongosh与CN不匹配。If the hostname does not match the 如果主机名与SAN (or CN), mongosh will fail to connect.SAN（或CN）不匹配，mongosh将无法连接。
Starting in MongoDB 4.2, when performing comparison of SAN, MongoDB supports comparison of DNS names or IP addresses. 从MongoDB 4.2开始，在执行SAN比较时，MongoDB支持比较DNS名称或IP地址。In previous versions, MongoDB only supports comparisons of DNS names.在以前的版本中，MongoDB仅支持比较DNS名称。
To connect 要将mongosh to a mongod or mongos that requires TLS/SSL, specify the --host option or use a connection string to specify the hostname. mongosh连接到需要TLS/SSL的mongod或mongos，请指定--host选项或使用连接字符串指定主机名。All other 必须使用命令行选项指定所有其他TLS/SSL options must be specified using the command-line options.TLS/SSL选项。
tls Options)tls选项）The procedure uses the 该过程使用tls options (available starting in MongoDB 4.2). tls选项（从MongoDB 4.2开始可用）。For procedures using their 有关使用ssl aliases, see mongosh Configuration (Using ssl Options).ssl别名的过程，请参阅mongosh配置（使用ssl选项）。
To connect to a 要连接到需要加密通信的mongod or mongos instance that requires encrypted communication, start mongosh with:mongod或mongos实例，请使用以下命令启动mongosh：
--tls--host--tlsCAFileFor example, consider a 例如，考虑一个在mongod instance running on hostname.example.com with the following options:hostname.example.com上运行的mongod实例，其中包含以下选项：
mongod --tlsMode requireTLS --tlsCertificateKeyFile <pem>
To connect to the instance, start 要连接到实例，请使用以下选项启动mongosh with the following options:mongosh：
mongosh --tls --host hostname.example.com --tlsCAFile /etc/ssl/caToValidateServerCertificates.pem
mongosh verifies the certificate presented by the 根据指定的主机名和CA文件验证mongod instance against the specified hostname and the CA file.mongod实例提供的证书。
tls Options)tls选项）The procedure uses the 该过程使用tls options (available starting in MongoDB 4.2). tls选项（从MongoDB 4.2开始可用）。For procedures using their 有关使用ssl aliases, see mongosh Configuration (Using ssl Options).ssl别名的过程，请参阅mongosh配置（使用ssl选项）。
To connect to a 要连接到需要CA签名客户端证书的mongod or mongos that requires CA-signed client certificates, start mongosh with:mongod或mongos，请使用以下命令启动mongosh：
--tls--host--tlsCAFile--tlsCertificateKeyFileFor example, consider a 例如，考虑一个在mongod instance running on hostname.example.com with the following options:hostname.example.com上运行的mongod实例，其中包含以下选项：
mongod --tlsMode requireTLS --tlsCertificateKeyFile /etc/ssl/mongodb.pem --tlsCAFile /etc/ssl/caToValidateClientCertificates.pem
To connect to the instance, start 要连接到实例，请使用以下选项启动mongosh with the following options:mongosh：
mongosh --tls --host hostname.example.com --tlsCertificateKeyFile /etc/ssl/client.pem --tlsCAFile /etc/ssl/caToValidateServerCertificates.pem
You can also use the 您还可以使用--tlsCertificateSelector option to specify the client certificate from the system certificate store instead of using --tlsCertificateKeyFile. --tlsCertificateSelector选项指定来自系统证书存储的客户端证书，而不是使用--tls证书KeyFile。If the CA file is also in the system certificate store, you can omit the 如果CA文件也在系统证书存储中，也可以省略--tlsCAFile option as well. --tlsCAFile选项。For example, to use a certificate with the 例如，要使用CN (Common Name) of myclient.example.net and the CA file from the system certificate store on macOS, start mongosh with the following options:myclient.example.net的CN（公用名）证书和macOS上系统证书存储中的CA文件，请使用以下选项启动mongosh：
mongosh --tls --host hostname.example.com --tlsCertificateSelector subject="myclient.example.net"
Although still available, 尽管mongosh--ssl, --sslCAFile, --sslPEMKeyFile, and --sslCertificateSelector options are deprecated as of MongoDB 4.2.mongosh的--ssl、--sslCAFile、--sslPEMKeyFile和--sslCertificateSelector选项仍然可用，但从MongoDB 4.2开始，这些选项已被弃用。
--tlsAllowInvalidCertificates Option--tlsAllowInvalidCertificates选项Although available, avoid using the 尽管可用，但尽可能避免使用--tlsAllowInvalidCertificates option if possible. --tlsAllowInvalidCertificates选项。If the use of 如果需要使用--tlsAllowInvalidCertificates is necessary, only use the option on systems where intrusion is not possible.--tlsAllowInvalidCertificates，请仅在不可能入侵的系统上使用该选项。
If 如果mongosh runs with the --tlsAllowInvalidCertificates option, mongosh will not attempt to validate the server certificates. mongosh使用--tlsAllowInvalidCertificates选项运行，mongosh将不会尝试验证服务器证书。This creates a vulnerability to expired 这会造成对过期的mongod and mongos certificates as well as to foreign processes posing as valid mongod or mongos instances. mongod和mongos证书以及冒充有效mongod或mongos实例的外部进程的漏洞。If you only need to disable the validation of the hostname in the TLS/SSL certificates, see 如果只需要禁用TLS/SSL证书中主机名的验证，请参阅--tlsAllowInvalidHostnames.--tlsAllowInvalidHostnames。
mongoshssl Options)ssl选项）mongosh provides various TLS/SSL settings, including:提供了各种TLS/SSL设置，包括：
| Notes | |
|---|---|
--ssl | |
--sslPEMKeyFile | .pem file that contains mongosh's certificate and key to present to the mongod or mongos instance. mongosh证书和密钥的.pem文件，以提供给mongod或mongos实例。 |
--sslPEMKeyPassword | mongosh's certificate key file is encrypted.mongosh的证书密钥文件已加密。 |
--sslCAFile | .pem file for verification of the certificate presented by the mongod or the mongos instance. .pem文件，用于验证mongod或mongos实例提供的证书。 |
--sslCertificateSelector |
For a complete list of 有关ssl options, see SSL Options.ssl选项的完整列表，请参阅ssl选项。
For TLS/SSL connections, 对于TLS/SSL连接，mongosh validates the certificate presented by the mongod or mongos instance:mongosh验证mongod或mongos实例提供的证书：
mongosh--sslCAFile. --sslCAFile。mongosh will fail to connect.mongosh将无法连接。mongosh verifies that the hostname (specified in 验证主机名（在--host option or the connection string) matches the SAN (or, if SAN is not present, the CN) in the certificate presented by the mongod or mongos. --host选项或连接字符串中指定）是否与mongod或mongos提供的证书中的SAN（如果没有SAN，则为CN）匹配。If 如果存在SAN is present, mongosh does not match against the CN. SAN，则mongosh与CN不匹配。If the hostname does not match the 如果主机名与SAN (or CN), mongosh will fail to connect.SAN（或CN）不匹配，mongosh将无法连接。
Starting in MongoDB 4.2, when performing comparison of SAN, MongoDB supports comparison of DNS names or IP addresses. 从MongoDB 4.2开始，在执行SAN比较时，MongoDB支持比较DNS名称或IP地址。In previous versions, MongoDB only supports comparisons of DNS names.在以前的版本中，MongoDB仅支持比较DNS名称。
To connect 要将mongosh to a mongod or mongos that requires TLS/SSL, specify the --host option or use a connection string to specify the hostname. mongosh连接到需要TLS/SSL的mongod或mongos，请指定--host选项或使用连接字符串指定主机名。All other 必须使用命令行选项指定所有其他TLS/SSL options must be specified using the command-line options.TLS/SSL选项。
--ssl Options)--ssl选项）The procedure uses the 该过程使用ssl options. ssl选项。For procedures using the 有关使用tls aliases (available starting in MongoDB 4.2), see mongosh Configuration (Using tls Options).tls别名的过程（从MongoDB 4.2开始可用），请参阅mongosh配置（使用tls选项）。
To connect to a 要连接到需要加密通信的mongod or mongos instance that requires encrypted communication, start mongosh with:mongod或mongos实例，请使用以下命令启动mongosh：
--ssl--host--sslCAFileFor example, consider a 例如，考虑一个在mongod instance running on hostname.example.com with the following options:hostname.example.com上运行的mongod实例，其中包含以下选项：
mongod --sslMode requireSSL --sslPEMKeyFile <pem>
To connect to the instance, start 要连接到实例，请使用以下选项启动mongosh with the following options:mongosh：
mongosh --ssl --host hostname.example.com --sslCAFile /etc/ssl/caToValidateServerCertificates.pem
mongosh verifies the certificate presented by the 根据指定的主机名和CA文件验证mongod instance against the specified hostname and the CA file.mongod实例提供的证书。
ssl Options)ssl选项）The procedure uses the 该过程使用ssl options. ssl选项。For procedures using the 有关使用tls aliases (available starting in MongoDB 4.2), see mongosh Configuration (Using tls Options).tls别名的过程（从MongoDB 4.2开始可用），请参阅mongosh配置（使用tls选项）。
To connect to a 要连接到需要CA签名客户端证书的mongod or mongos that requires CA-signed client certificates, start mongosh with:mongod或mongos，请使用以下命令启动mongosh：
--ssl--host--sslCAFile--sslPEMKeyFileFor example, consider a 例如，考虑一个在mongod instance running on hostname.example.com with the following options:hostname.example.com上运行的mongod实例，其中包含以下选项：
mongod --sslMode requireSSL --sslPEMKeyFile /etc/ssl/mongodb.pem --sslCAFile /etc/ssl/ca.pem
To connect to the instance, start 要连接到实例，请使用以下选项启动mongosh with the following options:mongosh：
mongosh --ssl --host hostname.example.com --sslPEMKeyFile /etc/ssl/client.pem --sslCAFile /etc/ssl/ca.pem
You can also use the 您还可以使用--sslCertificateSelector option to specify the client certificate from the system certificate store instead of using --sslPEMKeyFile. --sslCertificateSelector选项从系统证书存储中指定客户端证书，而不是使用--sslPEMKeyFile。If the CA file is also in the system certificate store, you can omit the 如果CA文件也在系统证书存储中，也可以省略--sslCAFile option as well. --sslCAFile选项。For example, to use a certificate with the 例如，要使用CN (Common Name) of myclient.example.net and the CA file from the system certificate store on macOS, start mongosh with the following options:myclient.example.net的CN（公用名）证书和macOS上系统证书存储中的CA文件，请使用以下选项启动mongosh：
mongosh --ssl --host hostname.example.com --sslCertificateSelector subject=myclient.example.net
--sslAllowInvalidCertificates Option--sslAllowInvalidCertificates选项Although available, avoid using the 尽管可用，但尽可能避免使用--sslAllowInvalidCertificates option if possible. --sslAllowInvalidCertificates选项。If the use of 如果需要使用--sslAllowInvalidCertificates is necessary, only use the option on systems where intrusion is not possible.--sslAllowInvalidCertificates，请仅在不可能入侵的系统上使用该选项。
If 如果mongosh (and other MongoDB Tools) runs with the --sslAllowInvalidCertificates option, mongosh (and other MongoDB Tools) will not attempt to validate the server certificates. mongosh（和其他MongoDB工具）使用--sslAllowInvalidCertificates选项运行，mongosh将不会尝试验证服务器证书。This creates a vulnerability to expired 这会造成对过期的mongod and mongos certificates as well as to foreign processes posing as valid mongod or mongos instances. mongod和mongos证书以及冒充有效mongod或mongos实例的外部进程的漏洞。If you only need to disable the validation of the hostname in the TLS/SSL certificates, see 如果只需要禁用TLS/SSL证书中主机名的验证，请参阅--sslAllowInvalidHostnames.--sslAllowInvalidHostnames。
MongoDB Atlas uses TLS/SSL to encrypt the connections to your databases.MongoDB Atlas使用TLS/SSL加密与数据库的连接。
The MongoDB Cloud Manager and Ops Manager Monitoring agents use encrypted communication to gather its statistics. MongoDB云管理器和Ops Manager监控代理使用加密通信来集合其统计信息。Because the agents already encrypt communications to the MongoDB Cloud Manager/Ops Manager servers, this is just a matter of enabling TLS/SSL support in MongoDB Cloud Manager/Ops Manager on a per host basis.由于代理已经加密与MongoDB Cloud Manager/Ops Manager服务器的通信，因此这只是基于每台主机在MongoDB云管理器/Ops Manager中启用TLS/SSL支持的问题。
For more information, see:有关详细信息，请参阅：
The MongoDB Drivers support encrypted communication. See:MongoDB驱动程序支持加密通信。请参见：
Various MongoDB utility programs support encrypted communication. These tools include:各种MongoDB实用程序支持加密通信。这些工具包括：
To use encrypted communication with these tools, use the same 要使用这些工具进行加密通信，请使用与ssl options as mongosh. mongosh相同的ssl选项。See 请参阅mongosh Configuration (Using ssl Options).mongosh配置（使用ssl选项）。