I am using nodejs mongodb driver to connect to a self signed mongodb instance. The MongoDB and Mongo Shell version is 4.0.0. Below is the command to launch a self signed mongodb instance:

mongod --port 27018 --sslMode requireSSL --sslPEMKeyFile mongodb.pem  --dbpath data

when I connect to this server with mongo shell, I can use below command without pem file:

mongo --port 27018 --ssl --sslAllowInvalidCertificates

I wonder what the PEM file is used for in the connection.


As per MongoDB documentation here Before you can use TLS/SSL, you must have a .pem file containing a public key certificate and its associated private key.

Note : For FIPS mode, ensure that the certificate is FIPS-compliant (i.e use of FIPS-compliant algorithms) and the private key meets the PKCS#8 standard. If you need to convert a private key to PKCS#8 format, various conversion tools exist, such as openssl pkcs8 and others.

MongoDB can use any valid TLS/SSL certificate issued by a certificate authority, or a self-signed certificate. If you use a self-signed certificate, although the communications channel will be encrypted, there will be no validation of server identity. Although such a situation will prevent eavesdropping on the connection, it leaves you vulnerable to a man-in-the-middle attack. Using a certificate signed by a trusted certificate authority will permit MongoDB drivers to verify the server’s identity.

In general, avoid using self-signed certificates unless the network is trusted.

This operation generates a new, self-signed certificate with no passphrase that is valid for 365 days. Once you have the certificate, concatenate the certificate and private key to a .pem file, as in the following example:

cat mongodb-cert.key mongodb-cert.crt > mongodb.pem

For your further ref here

  • This is what I did. My question is not about how to generate a self signed instance. The question is why connecting to a self-signed mongodb doesn't require private key. – Zhao Yi Aug 26 '18 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.