Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Following instructions outlined in MongoDB SSL encryption and Spring's Driver, I got 2.1.0 and after building it, it says it doesn't recognize sslOnNormalPorts, sslPEMKeyFile or sslPEMKeyPassword.

But I saw a --keyFile, and used it (I had to strip out the leading and trailing -----BEGIN RSA PRIVATE KEY---- and -----END RSA PRIVATE KEY----, and trailing '==' from the Base64 encoded key).

Now if I launch the mongo shell, all my commands work fine (show dbs, use xyz, etc.)

If I try to specify host and port I get:

mongo --host --port 27017 MongoDB shell version: 2.1.0 connecting to:

show dbs Mon Apr 30 21:37:37 uncaught exception: listDatabases failed:{ "errmsg" : "need to login", "ok" : 0 }

If I add --ssl flag to launch mongo shell, it just hangs. While mongod spits out:

Mon Apr 30 21:40:53 [initandlisten] options: { keyFile: "/Users/tshrestha/Downloads/key.pem" }
Mon Apr 30 21:40:53 [initandlisten] journal dir=/data/db/journal
Mon Apr 30 21:40:53 [initandlisten] recover : no journal files present, no recovery needed 
Mon Apr 30 21:40:53 [websvr] admin web console waiting for connections on port 28017
Mon Apr 30 21:40:53 [initandlisten] waiting for connections on port 27017
Mon Apr 30 21:41:16 [initandlisten] connection accepted from #1 (1 connection now open)
Mon Apr 30 21:41:53 [clientcursormon] mem (MB) res:14 virt:2419 mapped:0

I am on Mac OSX 10.7

share|improve this question

The keyfile option is for authentication between mongod instances, not SSL - it is treating your stripped down SSL key as simply a string of characters. What you have there is a really long password, nothing more. See here for more info:

You are missing the piece where you have to recompile using scons with the ssl flag. Re-read this page:

You need to follow the instructions there until you get to the part where it says this:

scons all

For an SSL enabled build you will need to use:

scons --ssl all

Once the build finishes, mongod will recognize your SSL related options. Note - I have done this on Mac OS X many times without a problem.

share|improve this answer
That is what I did.. scons --ssl all and then scond --ssl install: not sure if the second one is expected. – Ustaman Sangat May 2 '12 at 20:53
Since 2.1.0 didn't recognize any of the --sslOnNormalPorts --sslPEMKeyFile <pem> --sslPEMKeyPassword <pass> options, I got and built 2.0.4. It seemed to accept those flags but still don't think it worked. – Ustaman Sangat May 2 '12 at 20:55
my guess would be that the install didn't work and you weren't running the one you built with SSL enabled. I have used the method described on OS X and Linux without a hitch, but never an install (I was just running it from a folder directly). If 2.0.4 accepted the options then it would have started up with SSL and you would have had to use the --ssl option in order to connect - otherwise it would just reject the connection – Adam C May 2 '12 at 23:55
It worked with two caveats: even if the certificate does not have a password I have to type garbage for --sslPEMKeyPassword and the file passed to --sslPEMKeyFile had to contain both CERTIFICATE and RSA PRIVATE KEY segments. My next step would be to see if mutual TLS is supported by Mongo. – Ustaman Sangat May 3 '12 at 0:18
By mutual TLS, I meant exclusively so, clients must present there certificates. In which case, I would expect to see an option to specify the CA certificate. – Ustaman Sangat May 3 '12 at 3:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.