openssl genpkey -algorithm RSA -out ca.key
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt -subj “/CN=JQRootCA”
openssl genpkey -algorithm RSA -out mongodb.key
openssl req -new -key mongodb.key -out mongodb.csr -subj “/CN=0.0.0.0”
openssl x509 -req -in mongodb.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out mongodb.crt -days 3650 -sha256
cat mongodb.crt mongodb.key > mongodb-cert.pem

以上是创建自签名证书

path/to/ 需要替换成自己的地址
sudo chown mongodb:mongodb /path/to/mongodb-cert.pem /path/to/ca.crt
sudo chmod 600 /path/to/mongodb-cert.pem /path/to/ca.crt

/etc/mongo.conf 文件

network interfaces

net:
port: 27017
bindIp: 0.0.0.0
tls:
mode: requireTLS
allowConnectionsWithoutCertificates: true #这里是允许不验证tls
certificateKeyFile: /xxx/ssl/mongodb-cert.pem
CAFile: /xxx/ssl/ca.crt