MongoDB 4 Quick Start Guide

x.509 certificates

In order to use TLS, you need to either acquire or generate certificates for your servers and clients. In a production environment, these would be signed by a Certificate Authority (CA) (https://en.wikipedia.org/wiki/Certificate_authority). There are a number of commercial organizations that provide this service (for a fee, of course!), including IdenTrust (https://identrust.com/), Comodo (https://www.comodo.com/), and DigiCert (https://www.digicert.com/).  Another way to obtain a signed certificate might be through internet service providers, who often include a digital certificate in their offerings. Finally, consider using free open source certificate authorities, including Let's Encrypt (https://letsencrypt.org/), which ...