An X.509 certificate is a public-key-infrastructure credential that authenticates MongoDB clients and cluster nodes. It uses encryption and digital signatures to bind trusted identities to secure connections, and can provide mutual authentication so both sides verify each other before connecting. section 20.2.1
Choose X.509 certificates when the security model and operating environment justify certificate-based identity:
- Use them for high-trust environments such as financial services, health care, and government, where access should be limited to authenticated and trusted entities. section 20.2.1
- Prefer them over SCRAM when mutual client-server authentication and PKI-based communications matter more than password-based simplicity. section 20.2.1 section 20.2.3
- Account for certificate administration by choosing between Atlas-managed and self-managed X.509 certificates. section 20.2.1
A regulated MongoDB deployment
A health-care application connecting to Atlas can use X.509 certificates so clients and cluster nodes authenticate through PKI and verify one another before establishing secure connections. section 20.2.1 section 20.2.3


