KMES Series 3, application version 6.3.1.3 or later, with the KMIP license enabled and initial setup completed (including loading a Platform Master Key and network configuration).
Allow outbound TCP port 5696 (default KMIP port) from the machine running MongoDB to the KMES Series 3, specified by FQDN (for example, kmes.example.com) or CIDR (for example, 10.0.0.0/24).
TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the KMES FQDN(s) from inspection. Configure the KMES Series 3 with an FQDN so the exemption applies.