Description

Ensure every Atlas cluster accepts only encrypted TLS connections and that its Minimum TLS Protocol Version is set to TLS 1.2 or higher, so that data moving between applications and the cluster is protected and old, insecure TLS versions are refused.

Rationale

Without TLS, credentials and data could be read or changed by anyone on the network path. Atlas requires TLS for all connections and now rejects the weak TLS 1.0 and 1.1 versions. Explicitly setting the minimum to TLS 1.2 or TLS 1.3 confirms the cluster only uses modern, secure versions and lets you move to TLS 1.3 for stronger protection.

Impact

  • All connections use modern, secure TLS

  • Protects data and credentials in transit

  • Very old drivers that only support TLS 1.0 or 1.1 cannot connect

Default Value

Atlas requires TLS for all connections and no longer supports TLS 1.0 or 1.1; all clusters reject connections that use them. The minimum TLS version (1.2 or 1.3) can be set per cluster.

Pre-Requisites

  • Project Owner or Project Cluster Manager role

  • Applications using drivers that support TLS 1.2 or higher

Test Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, click Clusters, find the cluster, and click Edit Configuration.

  4. Expand the Additional Settings panel.

  5. Under Additional Settings, open More Configuration Options.

  6. Check the Set Minimum TLS Protocol Version value.

  7. Alternatively, run: atlas clusters advancedSettings describe <clusterName> and check minimumEnabledTlsProtocol.

  8. If it is not TLS 1.2 or TLS 1.3, or the check still reports TLS as disabled, follow the implementation steps.

Implementation Steps

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, click Clusters, find the cluster, and click Edit Configuration.

  4. Expand the Additional Settings panel.

  5. Under Additional Settings, open More Configuration Options.

  6. Set Minimum TLS Protocol Version to TLS 1.2 (or TLS 1.3). If you use a custom cipher suite configuration, update it to include the ciphers for the selected version.

  7. Click Review Changes, then click Apply Changes. Atlas performs a rolling restart. You can also run: atlas clusters advancedSettings update <clusterName> --tlsProtocol TLS1_2

  8. Confirm that applications can still connect.

Backout Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, click Clusters, find the cluster, and click Edit Configuration.

  4. Expand the Additional Settings panel.

  5. Under Additional Settings, open More Configuration Options.

  6. Set Minimum TLS Protocol Version back to its previous value (TLS 1.2 or higher, since Atlas no longer accepts TLS 1.0 or 1.1).

  7. Click Review Changes, then click Apply Changes.

Reference