Docs

Document Database for MongoDB

Data security

Connecting to database using Mongo shell via SSL encryption

Document Database for MongoDB provides SSL (Secure Sockets Layer) encryption service. You can enable SSL encryption in advance, and improve the security of the data link by setting SSL encryption when connecting to database using Mongo shell via SSL encryption. This topic describes how to access the database using MongoDB shell with SSL encryption.

Prerequisite

SSL has been enabled for instances. For specific procedure, refer to Setting SSL encryption.

If you need to use ECS to access MongoDB instance, ensure that the purchased ECS server and the MongoDB instance are in the same VPC. For specific procedures to purchase ECS instance, refer to Purchasing ECS instance.

Add the IP address of the local server or ECS instance with the client installed to allowlist of MongoDB instance. For specific procedures, refer to Setting allowlist.

Install the correct version of the mongo shell tool on your local machine or an ECS instance:

MongoDB 4.x: For detailed installation steps, refer to mongo shell.

MongoDB 5.0 and later: For detailed installation steps, refer to MongoDB shell.

Precautions

Accessing MongoDB instances through a private network is relatively secure, and typically requires no data link encryption. Using SSL for connection will increase the CPU utilization of MongoDB instances. We recommend you enable SSL only for the need of encryption, for example, connecting to the database over the Internet.

Procedure

The procedure for connecting to a database in SSL mode on the Linux operating system (installed on ECS instance) is as follows.

Download the SSL CA certificate. For specific procedures, refer to Setting SSL encryption.

Decompress the certificate package, and upload the certificate to the local server or ECS instance where Mongo shell is installed.

For example, upload the .pem certificate to the root/mongodbsslca directory of ECS.

On a local server or ECS with mongo shell installed, enter the following command to connect to the MongoDB instance.

# If the Mongo shell version is less than 4.2, use the following command:
mongo --host <host> -u <username> -p --authenticationDatabase <database> --ssl --sslCAFile <sslCAFile_path> --sslAllowInvalidHostnames
# If the Mongo shell version is greater than or equal to 4.2, use the following command:
mongo --host <host> -u <username> -p --authenticationDatabase <database> --tls --tlsCAFile <sslCAFile_path> --tlsAllowInvalidHostnames

The descriptions of the relevant parameters in the command are shown in the following table.

Parameter	Description	Example
<host>	Address of a single node, including the domain name and port number. Supports using the connection addresses of the following nodes: Replica set instances: Each node in instance. Sharding cluster instance Each Mongos node. Each node in a single shard. Each ConfigServer node. tip Only the private addresses of Mongos nodes are provided in MongoDB sharding cluster instances. To use private addresses of shard nodes or ConfigServer nodes, apply for them separately. For specific procedures, refer to Applying for private address. To connect to the database by using a public address, apply for the public address first. For specific procedures, refer to Applying for public address.	Replica set instance Private address of a single node mongoreplicae9d7d321**0.mongodb.ivolces.com:3717 Public address of a single node mongoreplicae9d7d3210.mongodb.volces.com:3717 Sharding cluster instance Public address of a single Mongos node mongoshard75fef3010.mongodb.volces.com:3717 Public address of a single node in a shard mongoshard75fef301s00.mongodb.volces.com:3717 Private address of a single ConfigServer node mongoshard75fef301**config0.ivolces.com:3717
<username>	The database account to connect to. The default MongoDB account is root. Do not directly use the root account to connect to the database in a production environment. You can create accounts and assign permissions to them based on business requirements. For more information, refer to Creating account and Account permissions.	root
<database>	The database to which the account belongs. tip When the database account is root, the corresponding database must be admin.	admin
<sslCAFile_path>	Path to the SSL CA certificate file.	/root/mongodbsslca/mongoshellshard.pem

The following example demonstrates accessing database using SSL encrypted connection, with the public network address of a Mongos node in a sharding cluster instance.

mongo --host mongoshard75fef3010****01.mongodb.volces.com:3717 -u root -p --authenticationDatabase admin --tls --tlsCAFile /root/mongodbsslca/mongoshellshard.pem --tlsAllowInvalidHostnames

When the command line prompts Enter password:, enter the password for the database account and press Enter to confirm.

If you forget the password for the root account, you can reset it on the MongoDB console. For specific procedures, refer to Resetting password.

Last updated: 2026.02.09 17:03:13