MongoDB Academy · 课时

静态数据加密与传输中的 TLS

学习者将为客户端连接启用 TLS，并了解 WiredTiger 的静态数据加密以及 Atlas 内置的加密存储功能。

第 3 / 4 课13 个步骤

静态数据加密与传输中的 TLS 是 CoddyKit 上的免费 MongoDB Academy 课时。这是第 3 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 MongoDB Academy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 MongoDB Academy 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Two Layers of Database Encryption

Securing MongoDB data requires protection at two distinct points: encryption in transit (data moving between clients and MongoDB, or between replica set members) and encryption at rest (data stored on disk). Authentication controls who can connect, but even an authenticated user operating over an unencrypted connection exposes credentials and queries to network sniffing. Together, TLS and encryption at rest provide defence-in-depth.

TLS: Encrypting Data in Transit

TLS (Transport Layer Security) encrypts the network channel between MongoDB clients, drivers, and mongod/mongos instances. Enabling TLS prevents eavesdropping and man-in-the-middle attacks on the wire. MongoDB 4.2+ supports only TLS 1.1 and higher, with TLS 1.3 available on modern platforms. Always use TLS in any environment where network traffic could be intercepted — which includes cloud VPCs despite VPC-level isolation.

Configuring TLS in mongod.conf

TLS is configured in the net.tls section of mongod.conf. Set mode: requireTLS to reject all unencrypted connections. You must provide a PEM file containing the server's certificate and private key. Optionally, provide a CAFile to require clients to present certificates signed by your CA (mutual TLS).

# mongod.conf — require TLS for all connections
net:
  port: 27017
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb-server.pem
    CAFile: /etc/ssl/ca.pem          # optional: require client certs
    disabledProtocols: TLS1_0,TLS1_1 # enforce TLS 1.2+

Connecting With TLS in the Node.js Driver

The official MongoDB Node.js driver enables TLS when the connection URI uses mongodb+srv:// (Atlas always uses TLS) or when the tls: true option is set. In self-hosted deployments, you may need to provide the CA file path so the driver can verify the server certificate. Use environment variables for certificate paths so they are not hardcoded in source code.

const { MongoClient } = require('mongodb')

// Self-hosted MongoDB with TLS
const client = new MongoClient('mongodb://myUser:myPass@dbhost:27017', {
  tls: true,
  tlsCAFile: process.env.MONGO_TLS_CA_FILE,
  // For mutual TLS (client certificate):
  // tlsCertificateKeyFile: process.env.MONGO_TLS_CERT_FILE
})

await client.connect()

// Atlas — TLS is enabled by default via SRV record
const atlasClient = new MongoClient(process.env.ATLAS_CONNECTION_STRING)

TLS Modes: disabled, allowTLS, preferTLS, requireTLS

MongoDB offers four TLS modes during migration phases. disabled accepts only plain connections (development only). allowTLS accepts both TLS and plain (for backward compatibility). preferTLS defaults to TLS but accepts unencrypted connections. requireTLS rejects all non-TLS connections and is the only mode acceptable for production deployments.

# Migration path: gradually enforce TLS
# Step 1: allowTLS (accept both)
# Step 2: preferTLS (default TLS, allow plain)
# Step 3: requireTLS (reject plain) <- production target
net:
  tls:
    mode: requireTLS

Encryption at Rest: WiredTiger

MongoDB's default storage engine, WiredTiger, supports Encrypted Storage Engine (available in MongoDB Enterprise). It encrypts data files on disk using AES-256-CBC or AES-256-GCM. Even if an attacker gains access to the physical disk or a disk snapshot, they cannot read the data without the encryption key. This addresses compliance requirements such as GDPR, HIPAA, and PCI-DSS that mandate protection of data at rest.

# mongod.conf — WiredTiger encryption at rest (Enterprise only)
security:
  enableEncryption: true
  encryptionKeyFile: /etc/mongodb/encryption-key  # AES-256 key

# Or use KMIP key management:
security:
  enableEncryption: true
  kmip:
    serverName: kmip.example.com
    port: 5696
    clientCertificateFile: /etc/ssl/kmip-client.pem

Atlas Encryption at Rest

MongoDB Atlas provides encryption at rest using cloud provider key management: AWS KMS, Azure Key Vault, or Google Cloud KMS. Customers can bring their own Customer Master Key (CMK), giving them full control — if you delete your CMK, Atlas cannot decrypt your data. Atlas's encryption at rest is enabled per project in the Security settings and applies to all clusters in that project.

Key Management Best Practices

Encryption is only as strong as the security of its keys. Follow these key management best practices: store encryption keys in a dedicated Key Management Service (KMS) rather than on the same server as the database; rotate encryption keys regularly (MongoDB supports key rotation without re-encrypting all data); use separate keys for development, staging, and production; and enable KMS audit logs to track all key access events.

TLS Certificate Rotation Without Downtime

TLS certificates expire, typically after 1–2 years. MongoDB supports online certificate rotation: you can deploy a new PEM file and send the rotateCertificates command to mongod, which picks up the new certificate for all new connections without restarting the process. Plan certificate renewal at least 30 days before expiry to avoid last-minute scrambles and production outages.

// Trigger online certificate rotation (mongosh)
db.adminCommand({ rotateCertificates: 1 })
// MongoDB reloads the certificate file specified in mongod.conf
// without dropping existing connections

Network-Level Security: IP Allowlisting and VPC

TLS and encryption at rest protect data on the wire and on disk, but network-level controls add another layer. In MongoDB Atlas, use IP Access List entries to whitelist only your application servers and developer IPs. For production, use VPC Peering or AWS PrivateLink so traffic between your application and Atlas never traverses the public internet, eliminating a large class of network-based attacks even before TLS is considered.

Auditing Encrypted Connections

Once TLS is enabled, verify that all connections are encrypted by checking the connPoolStats or the MongoDB connection log. MongoDB logs TLS handshake failures so you can identify any legacy client still attempting plaintext connections. In Atlas, the Monitoring tab shows active connections and their TLS status, making it easy to confirm full enforcement before removing the allowTLS mode.

// Check current connections (mongosh)
db.adminCommand({ currentOp: true }).inprog
  .filter(op => op.client)
  .map(op => ({ client: op.client, tls: op.clientMetadata }))

// Server status — TLS stats
db.serverStatus().network.serviceExecutorTaskStats

Quick Check

Test your understanding of MongoDB & NoSQL Databases concepts from this lesson.

在交互式课程中回答

Lesson Recap

In this lesson you learned: requireTLS in mongod.conf enforces encrypted client connections and should be the only mode used in production, WiredTiger Encrypted Storage Engine protects data files on disk (Enterprise) while Atlas provides CMK-based cloud encryption, and network-level controls like IP allowlists and VPC peering add layers of protection beyond TLS. Next up we cover Client-Side Field Level Encryption.

免费开始

用 AI 导师学习 JavaScript — 免费

在浏览器中编写并运行真实代码，获得全天候 AI 导师的即时帮助，并在网页或应用中继续学习。

课程: 30
课程: 120

免费开始学习查看完整课程

常见问题解答

「静态数据加密与传输中的 TLS」课时是免费的吗？

是的 — 「静态数据加密与传输中的 TLS」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 MongoDB Academy 课程的其余内容，请升级到 CoddyKit PRO。 MongoDB Academy 课程共包含 4 节课。

「静态数据加密与传输中的 TLS」这节课中我会学到什么？

学习者将为客户端连接启用 TLS，并了解 WiredTiger 的静态数据加密以及 Atlas 内置的加密存储功能。你通过在浏览器中直接运行的动手代码来练习 MongoDB Academy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 MongoDB Academy 需要有经验吗？

无需任何先前经验。CoddyKit 上的 MongoDB Academy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 3 节课，共 4 节。

「静态数据加密与传输中的 TLS」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 MongoDB Academy 课中编写并运行代码吗？

能。每节 MongoDB Academy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 MongoDB Academy