Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption

Expired TLS certificates can block new client connections and, when X.509 authentication is used, prevent replica set or sharded cluster members from authenticating with each other in Percona Server for MongoDB. The post explains how to perform a same-CA renewal using the rotateCertificates command to hot-reload TLS material without restarting mongod or mongos, covering certificateKeyFile and clusterFile options, validation steps after rotation, and warnings against using this procedure when the issuing CA, subject DN, or cluster-membership attributes change.

Source: https://www.percona.com/blog/rotating-expiring-x-509-certificates-in-percona-server-for-mongodb-with-minimal-service-interruption. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.