# Database Dynamic Secret x509 Client-side Auth mode

**URL:** <https://discuss.hashicorp.com/t/database-dynamic-secret-x509-client-side-auth-mode/19796>\
**Category:** Vault\
**Tags:** vault\
**Created:** [January 16, 2021, 11:45am UTC](https://discuss.hashicorp.com/t/database-dynamic-secret-x509-client-side-auth-mode/19796 "2021-01-16T11:45:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shifty21](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/shifty21/32/16474_2.png) [@shifty21](https://discuss.hashicorp.com/u/shifty21)\
**Post date:** [January 16, 2021, 11:45am UTC](https://discuss.hashicorp.com/t/database-dynamic-secret-x509-client-side-auth-mode/19796/1 "2021-01-16T11:45:14Z")

</div>

Vault’s database secret engine supports x509 Client-side auth mode ([MongoDB - Database - Secrets Engines | Vault by HashiCorp](https://www.vaultproject.io/docs/secrets/databases/mongodb))

I could use some more information on this.  
If the secret engine is configured in x509 auth mode that means MongoDB(in this case) will start with SSL enabled. And vault would generate username/password for communication from thereon. But, this means that all the connections to MongoDB will involve adding “sslAllowInvalidCertificates” flag or “InsecureSkipVerify” from the code to use the credentials generated by the vault. Doesn’t this defeat the purpose of enabling SSL? Shouldn’t vault generate certificates instead of username/password?

I am new to Vault and MongoDB!

---

<div class="post-metadata">

**Author:** ![daloulou](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/daloulou/32/14662_2.png) [@daloulou](https://discuss.hashicorp.com/u/daloulou)\
**Post date:** [July 13, 2022, 8:57am UTC](https://discuss.hashicorp.com/t/database-dynamic-secret-x509-client-side-auth-mode/19796/2 "2022-07-13T08:57:30Z")

</div>

Totally agree did you find any answer ?