TLS for Self-Managed MongoDB: Let’s Encrypt, mTLS, and the Future of Public Certs

MongoDB Atlas provides secure TLS out of the box, but implementing the same level of security in a self-managed MongoDB deployment can be challenging.

In this session, we demonstrate how to deploy MongoDB with automated TLS using Let’s Encrypt in a production-ready architecture. The talk covers certificate automation, secure client connections, and proper TLS configuration for replica sets running on AWS using services such as EC2 and Route53. A working Terraform example will also be provided so attendees can reproduce the infrastructure in their own environments.

We will also discuss upcoming industry changes affecting public certificate authorities. Starting in 2026, major public CAs will stop issuing certificates that support TLS client authentication, impacting MongoDB clusters that rely on public certificates for intra-cluster mTLS. The session explains what this means for replica sets and sharded clusters and presents practical mitigation strategies, including private CA architectures and alternative authentication approaches.

Attendees will leave with a practical blueprint for running MongoDB with automated, production-grade TLS while maintaining full infrastructure control.