Online TLS certificate rotation on self-managed mongod and mongos
Parent: MongoDB Security Architecture · Published reference · snapshot 2026-10-31
↓ Facts as markdownall context files
Source-anchored research for Online TLS certificate rotation on self-managed mongod and mongos. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- Validate certificate details and trust before deployment, retain previous files for rollback, and test a fresh connection after replacement. An established session alone does not demonstrate successful use of renewed material. Inspect rotation logs as part of validation. (high confidence) (verified as of 2026-10-31) [source]
How it works
- For MongoDB 8.0, replace configured PEM files, then run db.adminCommand({rotateCertificates: 1}) against each target mongod or mongos. The command was introduced in 5.0; db.rotateCertificates() wraps it. Rotation is process-local and can run regardless of replication status. (high confidence) (verified as of 2026-10-31) [source]
Problems, failure modes and limitations
- Incorrect, expired, revoked or missing certificate files cause rotation to fail without invalidating the loaded TLS configuration or terminating mongod or mongos. (high confidence) (verified as of 2026-10-31) [source]
- Only one rotation may run per process, regardless of replication status. A concurrent rotation errors; tlsCertificateSelector=thumbprint also fails rotation and logs a warning. (low confidence) (verified as of 2026-10-14) [source]
- Percona's August 31, 2026 procedure explicitly covers same-CA renewal with unchanged X.509 membership attributes. It excludes changing the issuing CA or subject identity from that procedure; this restriction does not mean MongoDB cannot reload a CA file. (high confidence) (verified as of 2026-08-31) [source]
Facts and statements
- Replacement files must retain their configured filenames and paths. Encrypted certificateKeyFile replacements must retain the configured password; interactive password prompting is unsupported. (high confidence) (verified as of 2026-10-31) [source]
- MongoDB 8.0 supports reloading TLS certificates, CA files and CRL files; CRL rotation is documented for Linux and Windows. (low confidence) (verified as of 2026-10-14) [source]
- Successful rotation preserves established connections using their old certificates; subsequent connections use the newly loaded certificates. (high confidence) (verified as of 2026-10-31) [source]
- The rotateCertificates privilege is required and is included in hostManager. Successful rotation logs certificate identity, thumbprint and validity information; enabled auditing also records it. (high confidence) (verified as of 2026-10-31) [source]
- Itential's MongoDB administration procedure replaces server and CA files and uses secondary-first rolling restarts with primary stepdown. That application-specific procedure does not establish that MongoDB 8.0 requires restarts for an eligible online reload. (medium confidence) (verified as of 2026-10-31) [source]
Children
- No children recorded.