# Online TLS certificate rotation on self-managed mongod and mongos > Source-anchored research for Online TLS certificate rotation on self-managed mongod and mongos. Run status: COMPLETED. Parent: [MongoDB Security Architecture](https://llms-explorer.com/tree/mongodb-security-architecture/) · 4 facets · 10 facts · page: https://llms-explorer.com/tree/online-tls-certificate-rotation-on-self-managed-mongod-and-mongos/ ## Structure and components - Validate certificate details and trust before deployment, retain previous files for rollback, and test a fresh connection after replacement. An established session alone does not demonstrate successful use of renewed material. Inspect rotation logs as part of validation. (high confidence) (verified as of 2026-10-31) — [source](https://www.mongodb.com/docs/v8.0/reference/command/rotateCertificates/) ## How it works - For MongoDB 8.0, replace configured PEM files, then run db.adminCommand({rotateCertificates: 1}) against each target mongod or mongos. The command was introduced in 5.0; db.rotateCertificates() wraps it. Rotation is process-local and can run regardless of replication status. (high confidence) (verified as of 2026-10-31) — [source](https://www.mongodb.com/docs/v8.0/reference/command/rotateCertificates/) ## Problems, failure modes and limitations - Incorrect, expired, revoked or missing certificate files cause rotation to fail without invalidating the loaded TLS configuration or terminating mongod or mongos. (high confidence) (verified as of 2026-10-31) — [source](https://www.mongodb.com/docs/v8.0/reference/command/rotateCertificates/) - Only one rotation may run per process, regardless of replication status. A concurrent rotation errors; tlsCertificateSelector=thumbprint also fails rotation and logs a warning. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/command/rotateCertificates.md) - Percona's August 31, 2026 procedure explicitly covers same-CA renewal with unchanged X.509 membership attributes. It excludes changing the issuing CA or subject identity from that procedure; this restriction does not mean MongoDB cannot reload a CA file. (high confidence) (verified as of 2026-08-31) — [source](https://www.mongodb.com/docs/v8.0/reference/command/rotateCertificates/) ## Facts and statements - Replacement files must retain their configured filenames and paths. Encrypted certificateKeyFile replacements must retain the configured password; interactive password prompting is unsupported. (high confidence) (verified as of 2026-10-31) — [source](https://www.mongodb.com/docs/v8.0/reference/command/rotateCertificates/) - MongoDB 8.0 supports reloading TLS certificates, CA files and CRL files; CRL rotation is documented for Linux and Windows. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/command/rotateCertificates.md) - Successful rotation preserves established connections using their old certificates; subsequent connections use the newly loaded certificates. (high confidence) (verified as of 2026-10-31) — [source](https://www.mongodb.com/docs/v8.0/reference/command/rotateCertificates/) - The rotateCertificates privilege is required and is included in hostManager. Successful rotation logs certificate identity, thumbprint and validity information; enabled auditing also records it. (high confidence) (verified as of 2026-10-31) — [source](https://www.mongodb.com/docs/v8.0/reference/command/rotateCertificates/) - Itential's MongoDB administration procedure replaces server and CA files and uses secondary-first rolling restarts with primary stepdown. That application-specific procedure does not establish that MongoDB 8.0 requires restarts for an eligible online reload. (medium confidence) (verified as of 2026-10-31) — [source](https://docs.itential.com/itential-platform/administer/mongodb)