Clients must have support for TLS/SSL to connect to a 客户端必须支持TLS/SSL才能连接到需要TLS/SSL连接的mongod or a mongos instance that require TLS/SSL connections.mongod或mongos实例。
Note
The Linux 64-bit legacy x64 binaries of MongoDB do not include support for TLS/SSL.MongoDB的Linux 64位旧式x64二进制文件不包括对TLS/SSL的支持。MongoDB disables support for TLS 1.0 encryption on systems where TLS 1.1+ is available.MongoDB在TLS 1.1+可用的系统上禁用对TLS 1.0加密的支持。
Important
A full description of TLS/SSL, PKI (Public Key Infrastructure) certificates, and Certificate Authority is beyond the scope of this document. This page assumes prior knowledge of TLS/SSL as well as access to valid certificates.TLS/SSL、PKI（公钥基础设施）证书和证书颁发机构的完整描述超出了本文档的范围。本页假设您已具备TLS/SSL的先验知识以及有效证书的访问权限。
MongoDB Shell
mongosh provides various TLS/SSL settings, including:提供各种TLS/SSL设置，包括：
| TLS Option | |
|---|---|
--tls | |
--tlsCertificateKeyFile |
|
--tlsCertificateKeyFilePassword | mongosh's certificate key file is encrypted.mongosh的证书键文件是加密的。 |
--tlsCAFile | .pem file for verification of the certificate presented by the mongod or the mongos instance..pem文件，用于验证mongod或mongos实例提供的证书。 |
--tlsCertificateSelector |
|
For a complete list of 有关mongosh's tls options, see TLS options.mongosh tls选项的完整列表，请参阅tls选项。
For TLS/SSL connections, 对于TLS/SSL连接，mongosh validates the certificate presented by the mongod or mongos instance:mongosh会验证mongod或mongos实例提供的证书：
mongoshverifies that the certificate is from the specified Certificate Authority (验证证书是否来自指定的证书颁发机构（--tlsCAFile.--tlsCAFile）。If the certificate is not from the specified CA,如果证书不是来自指定的CA，mongoshwill fail to connect.mongosh将无法连接。mongoshverifies that the hostname (specified in--hostoption or the connection string) matches theSAN(or, ifSANis not present, theCN) in the certificate presented by themongodormongos.mongosh验证主机名（在--host选项或连接字符串中指定）是否与mongod或mongos提供的证书中的SAN（或者，如果SAN不存在，则为CN）匹配。If如果存在SANis present,mongoshdoes not match against theCN.SAN，则mongosh与CN不匹配。If the hostname does not match the如果主机名与SAN(orCN),mongoshwill fail to connect.SAN（或CN）不匹配，mongosh将无法连接。Starting in MongoDB 4.2, when performing comparison of SAN, MongoDB supports comparison of DNS names or IP addresses. In previous versions, MongoDB only supports comparisons of DNS names.从MongoDB 4.2开始，在执行SAN比较时，MongoDB支持DNS名称或IP地址的比较。在以前的版本中，MongoDB只支持DNS名称的比较。To connect要将mongoshto amongodormongosthat requires TLS/SSL, specify the--hostoption or use a connection string to specify the hostname.mongosh连接到需要TLS/SSL的mongod或mongos，请指定--host选项或使用连接字符串指定主机名。All other必须使用命令行选项指定所有其他TLS/SSLoptions must be specified using the command-line options.TLS/SSL选项。
Connect to MongoDB Instances Using Encryption使用加密连接到MongoDB实例
To connect to a 要连接到需要加密通信的mongod or mongos instance that requires encrypted communication, start mongosh with:mongod或mongos实例，请使用以下命令启动mongosh：
--tls--hostand和--tlsCAFileto validate the server certificate.以验证服务器证书。
For example, consider a 例如，考虑一个在mongod instance running on hostname.example.com with the following options:hostname.example.com上运行的mongod实例，具有以下选项：
mongod --tlsMode requireTLS --tlsCertificateKeyFile <pem>To connect to the instance, start 要连接到实例，请使用以下选项启动mongosh with the following options:mongosh：
mongosh --tls --host hostname.example.com --tlsCAFile /etc/ssl/caToValidateServerCertificates.pemmongosh verifies the certificate presented by the 根据指定的主机名和CA文件验证mongod instance against the specified hostname and the CA file.mongod实例提供的证书。
Connect to MongoDB Instances that Require Client Certificates连接到需要客户端证书的MongoDB实例
To connect to a 要连接到需要CA签名的客户端证书的mongod or mongos that requires CA-signed client certificates, start mongosh with:mongod或mongos，请使用以下命令启动mongosh：
--tls--hostand the和--tlsCAFileto validate the server certificate,用于验证服务器证书，--tlsCertificateKeyFileoption to specify the client certificate to present to the server.选项用于指定要呈现给服务器的客户端证书。
For example, consider a 例如，考虑一个在hostnameexample.com上运行的mongod instance running on hostname.example.com with the following options:mongod实例，具有以下选项：
mongod --tlsMode requireTLS --tlsCertificateKeyFile /etc/ssl/mongodb.pem --tlsCAFile /etc/ssl/caToValidateClientCertificates.pemTo connect to the instance, start 要连接到实例，请使用以下选项启动mongosh with the following options:mongosh：
mongosh --tls --host hostname.example.com --tlsCertificateKeyFile /etc/ssl/client.pem --tlsCAFile /etc/ssl/caToValidateServerCertificates.pemWindows and macOS
To specify a client certificate from the system certificate store, use the 要从系统证书存储中指定客户端证书，请使用--tlsCertificateSelector option instead of --tlsCertificateKeyFile.--tlsCertificateSelector选项，而不是--tlsCertificateKeyFile。
If the CA file is also in the system certificate store, you can omit the 如果CA文件也在系统证书存储中，则可以省略--tlsCAFile option.--tlsCAFile选项。
For example, if a certificate with the 例如，如果带有CN (Common Name) of myclient.example.net and the accompanying CA file are both in the macOS system certificate store, you can connect like this:myclient.example.net的CN（Common Name）的证书和附带的CA文件都在macOS系统证书存储中，则可以按如下方式连接：
mongosh --tls --host hostname.example.com --tlsCertificateSelector subject="myclient.example.net"There are available in mongosh, but you should use the tls alternatives instead.mongosh中有可用的，但您应该使用tls替代品。
Avoid Use of --tlsAllowInvalidCertificates Option避免使用--tlsAllowInvalidCertificates选项
--tlsAllowInvalidCertificates OptionWarning
Although available, avoid using the 虽然可用，但如果可能的话，请避免使用--tlsAllowInvalidCertificates option if possible. If the use of --tlsAllowInvalidCertificates is necessary, only use the option on systems where intrusion is not possible.--tlsAllowInvalidCertificates选项。如果需要使用--tlsAllowInvalidCertificates，请仅在不可能发生入侵的系统上使用该选项。
If 如果mongosh runs with the --tlsAllowInvalidCertificates option, mongosh will not attempt to validate the server certificates. mongosh使用--tlsAllowInvalidCertificates选项运行，mongosh将不会尝试验证服务器证书。This creates a vulnerability to expired 这为过期的mongod and mongos certificates as well as to foreign processes posing as valid mongod or mongos instances. If you only need to disable the validation of the hostname in the TLS/SSL certificates, see --tlsAllowInvalidHostnames.mongod和mongos证书以及冒充有效mongod或mongos实例的外部进程创建了一个漏洞。如果只需要禁用TLS/SSL证书中的主机名验证，请参阅--tlsAllowInvalidHostnames。
MongoDB Atlas, MongoDB Cloud Manager and MongoDB Ops ManagerMongoDB Atlas、MongoDB云管理器和MongoDB运维管理器
MongoDB Atlas uses TLS/SSL to encrypt the connections to your databases.MongoDB Atlas使用TLS/SSL加密与数据库的连接。
The MongoDB Cloud Manager and Ops Manager Monitoring agents use encrypted communication to gather its statistics. Because the agents already encrypt communications to the MongoDB Cloud Manager/Ops Manager servers, this is just a matter of enabling TLS/SSL support in MongoDB Cloud Manager/Ops Manager on a per host basis.MongoDB Cloud Manager和Ops Manager监控代理使用加密通信来集合其统计数据。因为代理已经加密了与MongoDB Cloud Manager/Ops Manager服务器的通信，所以这只是在每个主机的基础上在MongoDB Cloud Manager/Eps Manager中启用TLS/SSL支持的问题。
For more information, see:有关更多信息，请参阅：
MongoDB Drivers驱动程序
The MongoDB Drivers support encrypted communication. For details, see:MongoDB驱动程序支持加密通信。有关详细信息，请参阅：
MongoDB Tools工具
Various MongoDB utility programs support encrypted communication. These tools include:各种MongoDB实用程序支持加密通信。这些工具包括：
To use encrypted communication with these tools, use the same 要使用这些工具进行加密通信，请使用与tls options as mongosh. See MongoDB Shell.mongosh相同的tls选项。请参阅MongoDB Shell。