TLS Encryption

Parent: MongoDB Atlas AWS Networking · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for TLS Encryption; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

How it works

[low] TLS 1.3 support was introduced in MongoDB 3.6.9, 4.0.4, and 4.2.0, and is enabled by default if supported by the operating system. (verified as of 2026-10-15) Sources: https://www.mongodb.com/community/forums/t/when-mongodb-dotnet-driver-support-tls1-3/256304 [source]
[low] The .NET/C# Driver does not enable TLS 1.3 by default due to .NET Standard limitations, but it can be enabled via code, with plans to enable TLS 1.3 and safer defaults in the 3.0.0 release. (verified as of 2026-10-15) Sources: https://www.mongodb.com/community/forums/t/when-mongodb-dotnet-driver-support-tls1-3/256304 [source]
[low] TLS 1.2 is currently supported in Atlas, while TLS 1.3 support is in development without a public availability date. (verified as of 2026-10-15) Sources: https://www.mongodb.com/community/forums/t/when-mongodb-dotnet-driver-support-tls1-3/256304 [source]
Fact 61 states TLS 1.3 support in Atlas is in the works without a public date, while Fact 60 states it is on by default if supported by the OS, and Fact 59 lists specific MongoDB versions where it was introduced. Sources: https://www.mongodb.com/community/forums/t/when-mongodb-dotnet-driver-support-tls1-3/256304 [source]

Problems, failure modes and limitations

[low] TLS 1.0 and 1.1 are formally deprecated; implementations must not negotiate these versions, and clients must not send ClientHello messages with protocol versions {03,01} or {03,02}. Sources: https://datatracker.ietf.org/doc/html/rfc8996 [source]
[low] Atlas prevents TLS configuration changes that could break inter-node communication during rolling updates, blocking unsafe transitions and returning the UNSAFE_TLS_TRANSITION error. Sources: https://www.mongodb.com/docs/atlas/reference/faq/security.md [source]

Facts and statements

[medium] Atlas enforces mandatory TLS encryption for connections to databases, with TLS 1.2 as the default protocol, and supports TLS versions 1.2 and 1.3. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md, https://www.mongodb.com/docs/atlas/reference/faq/security.md [source]
[low] Atlas requires TLS encryption for client data and intra-cluster network communications, and encrypts all cluster storage and snapshot volumes at rest using AES-256 by default. Sources: https://www.mongodb.com/docs/atlas/reference/faq/security.md [source]
[low] TLS 1.2 introduced SHA-2 family algorithms for hash, MAC, and PRF computations, and added authenticated encryption with associated data (AEAD) cipher suites. Sources: https://datatracker.ietf.org/doc/html/rfc8996 [source]
[medium] Atlas no longer supports TLS 1.0 or 1.1, rejecting all connection attempts using these versions, and requires the minimum TLS version to be set to 1.2 or higher. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/reference/faq/security.md, https://www.mongodb.com/docs/atlas/cluster-additional-settings.md [source]
[low] TLS 1.3 introduced a new handshake protocol, HKDF-based key derivation, and removed cipher suites using RSA key transport or static Diffie-Hellman key exchange. Sources: https://datatracker.ietf.org/doc/html/rfc8996 [source]
[low] TLS 1.0 makes TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA mandatory and relies on SHA-1 for handshake integrity, which is vulnerable to downgrade attacks requiring only 2^77 operations. Sources: https://datatracker.ietf.org/doc/html/rfc8996 [source]
[low] Atlas cluster nodes' TLS certificates are valid for 90 days, rotated 42 days before expiration, and signed by Google Trust Services or Let's Encrypt. Sources: https://www.mongodb.com/docs/atlas/reference/faq/security.md [source]
[low] Atlas uses GTS Root R3 and GTS Root R4 root CA certificates for TLS 1.3 support, and will require support for ISRG Root X1, GTS Root R1, and R2 certificates after June 2025. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/reference/faq/security.md [source]
[low] TLS 1.2 became the recommended IETF protocol version in 2008, subsequently obsoleted by TLS 1.3 in 2018. (verified as of 2026-10-15) Sources: https://datatracker.ietf.org/doc/html/rfc8996 [source]
[medium] If a custom TLS 1.2 cipher configuration is used, it must be updated to include TLS 1.3 ciphers to upgrade to TLS 1.3. Sources: https://www.mongodb.com/docs/atlas/reference/faq/security.md, https://www.mongodb.com/docs/atlas/cluster-additional-settings.md [source]

Related concepts

TLS — is a part of TLS Encryption
Encryption — is a part of TLS Encryption

Children

No children recorded.

← the whole tree · 3D view· how to read this page