Relevant for documentation: The second argument of the Mongo() constructor now takes an additional tlsOptions field, which is a map of KMSProvider → TLS options, and TLS options in turn refers to any of tlsCertificateKeyFile , tlsCertificateKeyFilePassword and tlsCAFile . Both file options expect filenames, not file contents. These options will be used when connecting to the KMS. This applies to all providers, but is particularly relevant for KMIP, since KMIP uses TLS certificate/key as its authentication mechanism. As a concrete example, a CSFLE connection using KMIP as the KMS provider can be established using the following: const connection = Mongo(url, { keyVaultNamespace: 'encryption.__keyVault', kmsProviders: { kmip: { endpoint: 'kmip.example.com:123' } }, tlsOptions: { kmip: { tlsCertificateKeyFile: '/path/to/client/cert-and-key-bundle.pem' } } });