New in version 5.0.
db.rotateCertificates()method takes the following optional argument:ParameterTypeDescription
messagestringoptional A message logged by the server to the log file and audit file.
db.rotateCertificates() method returns a document with
the following field:
Contains the command's execution status.
Rotation includes the following certificates:
CRL (Certificate Revocation List) files(on Linux and Windows platforms)
To rotate one or more of these certificates:
Replace the certificate or certificates you wish to rotate on the filesystem, noting the following constraints:
Each new certificate must have the same filename and same filepath as the certificate it is replacing.
If rotating an encrypted
TLS Certificate, its password must be the same as the password for the old certificate (as specified to the
certificateKeyFilePasswordconfiguration file setting). Certificate rotation does not support the interactive password prompt.
When certificate rotation takes place:
Any new connections will use the new certificates.
Only one instance of
rotateCertificates may run on each
mongos process at a time. Attempting to initiate a second
instance while one is already running will result in an error.
Incorrect, expired, revoked, or missing certificate files will cause the
certificate rotation to fail, but will not invalidate the existing
TLS configuration or terminate the running
On successful rotation, the subject names, thumbprints, and the validity period of the server and cluster certificate thumbprints are logged to the configured log destination. If auditing is enabled, this information is also written to the audit log.
On Linux and Windows platforms, if a
CRL file is present, its thumbprint and validity period are
also logged to these locations.
The following operation rotates the certificates on a running
mongod instance, after having made the appropriate
updates to the configuration file to specify the updated certificate
db.rotateCertificates("message": "Rotating certificates")