Establishing secure communications using PEM key files

Once you have access to valid server certificate and key files, they are generally combined into a single file referred to as a PEM file. Unfortunately, there are a number of variants of the PEM format, so you'll have to consult the documentation for the server's operating system. As an example, assuming you ran the install_ssl_cert.sh script described earlier, let's add the following to the existing MongoDB config file:

net:
  port: 27017
  bindIp: 0.0.0.0
  tls:
      mode: requireTLS
      certificateKeyFile: /etc/.certs/server.pem
      CAFile: /etc/.certs/ca.pem

Before you restart the mongod instance, be sure to perform a proper shutdown as follows:

mongo admin
> db.shutdownServer();
> exit

Notice that after we restart the mongod instance, when we try to connect using a client that does not connect using TLS, the connection is rejected, as seen in the screenshot:

If we subsequently modify the MongoDB config...