I am trying to setup a MongoDB with SSL/TLS enabled. I'm just wondering is there a way for clients to connect to my mongodb server without having a client certificate that would not compromise the security? (not considering --sslAllowInvalidCertificates or --tlsInsecure=true)
Just like how mongodb atlas is doing it.
Yes, you can set net.tls.allowConnectionsWithoutCertificates: true
Of course, net.tls.mode must not set to requireTLS, use preferTLS or allowTLS
Encryption of connection is provided by server certificate, the client certificate has effect on that. Also note, that the Subject Alternative Name (SAN) of client certificates are not checked when a connection is established. Thus in my opinion, a client certificate gives only minor security improvements, unless it is used for client authentication.
