Docs Menu

Docs HomeMongoDB Ops Manager

Encrypted Backup Snapshots

On this page

  • Prerequisites
  • Set up KMIP Host Configuration for Ops Manager
  • Configure Your Project to Use KMIP
  • Encrypt Your Backup Job

Snapshot encryption depends upon which version of MongoDB your database is compatible. This Feature Compatibility Version ranges from the current version to one version earlier. For MongoDB 4.2, the FCV can be 4.0 or 4.2. You can only create encrypted snapshots from encrypted clusters.

A host running KMIP-compliant key management to generate and store encryption keys.


You must maintain all keys, even rotated keys, in the KMIP host.

  1. Click Admin.

  2. Click General.

  3. Click Ops Manager Config.

  4. Click Backup tab.


See also:


Update the following KMIP host fields in the KMIP Server Configuration section:

KMIP Server Host
Type the FQDN for the KMIP host.
Type the port on which the KMIP host is listening for KMIP connections. The default KMIP port is 5696.
Type the absolute path for the Certificate Authority file on the Ops Manager host. This must be the same Certificate Authority file stored on the KMIP host.


All deployments in the project use the same KMIP client certificate file to authenticate.

  1. Click Admin

  2. Click Projects

  3. Under the <Project Name>, click More ....

  4. In the row for Backup Configuration, click View.


See also:

KMIP client certificate path

Type the absolute path for the client certificate file on the Ops Manager host. Ops Manager uses this certificate to authenticate itself to the KMIP server.

A single file can hold both the CA and client certificate.

KMIP client certificate password
Optional Only enter if the certificate specified in KMIP client certificate path is encrypted.
← Manage Two-Factor Authentication for Ops Manager