Important: The passphrase prompt option is available if you run the MongoDB instance in the foreground with a connected terminal. If you run mongod or mongos in a non-interactive session (e.g. without a terminal or as a service on Windows), you cannot use the passphrase prompt option. 

## Run in FIPS Mode 

Note: FIPS-compatible SSL is available only in MongoDB Enterprise$^{39}$. See Configure MongoDB for FIPS (page 351) for more information. 

See Configure MongoDB for FIPS (page 351) for more details. 

## TLS/SSL Configuration for Clients 

Clients must have support for TLS/SSL to work with a mongod or a mongos instance that has TLS/SSL support enabled. The current versions of the Python, Java, Ruby, Node.js, .NET, and C++ drivers have support for TLS/SSL, with full support coming in future releases of other drivers. 

Important: A full description of TLS/SSL, PKI (Public Key Infrastructure) certificates, and Certificate Authority is beyond the scope of this document. This page assumes prior knowledge of TLS/SSL as well as access to valid certificates. 

Note: Although TLS is the successor to SSL, this page uses the more familiar term SSL to refer to TLS/SSL. 

## See also: 

Configure mongod and mongos for TLS/SSL (page 342). 

## mongo Shell SSL Configuration 

For SSL connections, you must use the mongo shell built with SSL support or distributed with MongoDB Enterprise. 

New in version 3.0: Most MongoDB distributions now include support for SSL. 

The mongo shell provides various mongo-shell-ssl settings, including: 

• --ssl 

• --sslPEMKeyFile with the name of the .pem file that contains the SSL certificate and key. 

• --sslCAFile with the name of the .pem file that contains the certificate from the Certificate Authority (CA). 

Changed in version 3.0: When running mongo with the --ssl option, you must include either --sslCAFile or --sslAllowInvalidCertificates . 

This restriction does not apply to the MongoDB tools. However, running the tools without -sslCAFile creates the same vulnerability to invalid certificates. 

Warning: For SSL connections ( --ssl ) to mongod and mongos , if the mongo shell (or Mon- goDB tools (page 350)) runs without the --sslCAFile <CAFile> option (i.e. specifies the --sslAllowInvalidCertificates instead), the mongo shell (or MongoDB tools (page 350)) will not attempt to validate the server certificates. This creates a vulnerability to expired mongod and mongos certificates as well as to foreign processes posing as valid mongod or mongos instances. Ensure that you always specify the CA file to validate the server certificates in cases where intrusion is a possibility. 

