#### Make PEM containig a public key certificate and its associated private key
```bash
openssl req -newkey rsa:2048 -new -x509 -days 3650 -nodes -out mongo.crt -keyout mongo.key
cat mongo.key mongo.crt > mongo.pem
```

#### Edit _/etc/mongod.conf_, _network interfaces_ section
```apache
# network interfaces
net:
  port: 27017
  bindIp: 127.0.0.1
  ssl:
    mode: allowSSL
    PEMKeyFile: /etc/ssl/mongo.pem
    #CAFile: /etc/ssl/mongo.crt
```

#### Check for startup config errors
```bash
sudo mongod --config /etc/mongod.conf
```

#### Restart mongo
```bash
sudo service mongod restart
```

#### Test-connect
```bash
mongo --ssl --sslAllowInvalidHostnames --sslAllowInvalidCertificates
```

#### NodeJs, mongo connection options
```js
{ 
  "sslValidate": false,
  "sslKey": fs.readFileSync('/etc/ssl/mongodb.pem'),
  "sslCert": fs.readFileSync('/etc/ssl/mongodb-cert.crt')
}
```