Why should you care?

Coffee-shop Wi-Fi and cloud networks are hostile. Atlas forces TLS; self-managed clusters must enable it explicitly.

See it live — copy this example

Open mongosh or MongoDB Compass, select database nosqlverse, then run the example. Change one field and run again.

// mongosh with TLS to Atlas (srv already implies TLS)
mongosh "mongodb+srv://cluster0.xxxxx.mongodb.net/NoSQLVerse" --apiVersion 1 --username appUser
// Self-managed example flags (server):
// mongod --tlsMode requireTLS --tlsCertificateKeyFile /path/server.pem
// Client:
// mongosh --tls --tlsCAFile /path/ca.pem "mongodb://host:27017"

Run Example »

This lesson uses terminal or setup steps. Run commands on your computer — the live editor appears on coding lessons.

What happened?

• Atlas mongodb+srv connections use TLS by default.
• Self-managed setups require TLS mode and certificate files.
• Clients must trust the CA.
• Without TLS, SCRAM still helps but packets can be sniffed.

Practice next

1. Connect to Atlas and confirm the URI uses mongodb+srv.
2. In a lab, enable requireTLS on mongod with a test cert.
3. Fail a connection without TLS to see the deny.
4. Inspect driver options tls=true explicitly.
5. Set up mutual TLS (mTLS) in an advanced lab.

Remember

TLS protects data in transit. Atlas enables it by default on srv URIs. Validate certificates properly.

PCI network path

Payment services require TLS to Mongo for card-token metadata paths.

Outcome: Network sniffers see ciphertext only.