# Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption

DevFeed: [Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption](<https://devfeed.tech/articles/rotating-expiring-x-509-certificates-in-percona-server-for-mongodb-with-minimal-service-interruption-14114.md>)

Original publisher: [Read original article](<https://www.percona.com/blog/rotating-expiring-x-509-certificates-in-percona-server-for-mongodb-with-minimal-service-interruption/>)

Author: Ivan Groenewold

Published: 2026-08-31T11:48:11Z

Content type: tutorial

Language: en

Sources: [Blog - Percona](<https://devfeed.tech/sources/blog-percona.md>)

Topics: [MongoDB](<https://devfeed.tech/topics/mongodb.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [configuration](<https://devfeed.tech/topics/configuration.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [insight-for-dbas](<https://devfeed.tech/tags/insight-for-dbas.md>), [mongodb](<https://devfeed.tech/tags/mongodb.md>), [private-key](<https://devfeed.tech/tags/private-key.md>), [rotation](<https://devfeed.tech/tags/rotation.md>), [security](<https://devfeed.tech/tags/security.md>), [tls](<https://devfeed.tech/tags/tls.md>), [x509](<https://devfeed.tech/tags/x509.md>)

## AI overview

This tutorial explains how to renew same-CA X.509 certificates in Percona Server for MongoDB with minimal service interruption. It covers reloading TLS material with rotateCertificates, certificate and private-key configuration, limitations, validation, and cases where hot reload should not be used.

## Source excerpt

Expired TLS certificates can prevent new client connections and, when X.509 is used for Percona Server for MongoDB internal authentication, also prevent members of a replica set or sharded cluster from authenticating to one another. In this post we will discuss performing a same-CA renewal: replacement certificates for server, member, and client leaf are issued ... Continued The post Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption appeared first on Percona.